General
-
Target
dddec710759e113aef2a20c65157787d5c698dda7a4bc83aa5e245a253e4cc2a
-
Size
490KB
-
Sample
230507-kr2qzacd68
-
MD5
3237ba9fc7003847b847b33f0f13883f
-
SHA1
932f9c16dd9fd4516c94e64e18a857d0eae609f9
-
SHA256
dddec710759e113aef2a20c65157787d5c698dda7a4bc83aa5e245a253e4cc2a
-
SHA512
003a86ec744b0291f94bf90e17d8d7a24382d5333b044111a4fb89e0a0f50ccf07898109b849ee5357bafd6a60a8e12b30679d0b1b71f46872bfc1c982f09564
-
SSDEEP
12288:hMr2y90QLn+IvW7M3NcneSRqNMSbysp4JRU:DyVLn+yweIqNMSbyf6
Static task
static1
Behavioral task
behavioral1
Sample
dddec710759e113aef2a20c65157787d5c698dda7a4bc83aa5e245a253e4cc2a.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
lada
217.196.96.101:4132
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Targets
-
-
Target
dddec710759e113aef2a20c65157787d5c698dda7a4bc83aa5e245a253e4cc2a
-
Size
490KB
-
MD5
3237ba9fc7003847b847b33f0f13883f
-
SHA1
932f9c16dd9fd4516c94e64e18a857d0eae609f9
-
SHA256
dddec710759e113aef2a20c65157787d5c698dda7a4bc83aa5e245a253e4cc2a
-
SHA512
003a86ec744b0291f94bf90e17d8d7a24382d5333b044111a4fb89e0a0f50ccf07898109b849ee5357bafd6a60a8e12b30679d0b1b71f46872bfc1c982f09564
-
SSDEEP
12288:hMr2y90QLn+IvW7M3NcneSRqNMSbysp4JRU:DyVLn+yweIqNMSbyf6
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-