General
-
Target
fc757efe51f1fc9ebc1321429f04e60f2b5c9aa9e03948978682c24104536f60.bin
-
Size
1.7MB
-
Sample
230507-ksj8bace24
-
MD5
9590f3d2d80b6334efdbe11bdd0d3a8d
-
SHA1
8580cf81721bb4cf8649a962600347eddc7229fb
-
SHA256
fc757efe51f1fc9ebc1321429f04e60f2b5c9aa9e03948978682c24104536f60
-
SHA512
4b5c6d6c1d46c79d9e11d215fc1a15589d6d76ce1c2a0fbf73516a31fd916d27522070f3aa56412caa80dd2070e8dc1ca3dec4aae93a12db9821f3c880c800e3
-
SSDEEP
24576:2y2crw9Dz/7sFkOQVSP0+K/jVtvZUuiGXqsStqXNFSrncjPrEAFVrO91LrzeFkLT:F9w9DD7sUSPA/BtBU8bVj7Fc9h/eFC
Static task
static1
Behavioral task
behavioral1
Sample
fc757efe51f1fc9ebc1321429f04e60f2b5c9aa9e03948978682c24104536f60.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
fc757efe51f1fc9ebc1321429f04e60f2b5c9aa9e03948978682c24104536f60.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
most
185.161.248.73:4164
-
auth_value
7da4dfa153f2919e617aa016f7c36008
Targets
-
-
Target
fc757efe51f1fc9ebc1321429f04e60f2b5c9aa9e03948978682c24104536f60.bin
-
Size
1.7MB
-
MD5
9590f3d2d80b6334efdbe11bdd0d3a8d
-
SHA1
8580cf81721bb4cf8649a962600347eddc7229fb
-
SHA256
fc757efe51f1fc9ebc1321429f04e60f2b5c9aa9e03948978682c24104536f60
-
SHA512
4b5c6d6c1d46c79d9e11d215fc1a15589d6d76ce1c2a0fbf73516a31fd916d27522070f3aa56412caa80dd2070e8dc1ca3dec4aae93a12db9821f3c880c800e3
-
SSDEEP
24576:2y2crw9Dz/7sFkOQVSP0+K/jVtvZUuiGXqsStqXNFSrncjPrEAFVrO91LrzeFkLT:F9w9DD7sUSPA/BtBU8bVj7Fc9h/eFC
-
Detects Redline Stealer samples
This rule detects the presence of Redline Stealer samples based on their unique strings.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-