General
-
Target
02e01f99331d49d6c0b7924b1b004d63.bin
-
Size
155KB
-
Sample
230509-bcpnesfd6z
-
MD5
70b0acddaf38395464704350bf8d2a62
-
SHA1
2386be4c7f04680d29e2b5fe64b1bd7043bbecc4
-
SHA256
5264fa070c7ccca8b9b7dbd943cecbb639bc0e5463951f176ae2fa8f0aca211f
-
SHA512
2acdc704901bfc18ff7a512dc45e439c6463644ba7c765071b06807ca089b34c59e6c3f136fa2a0bce979c31256aca4f38dee910112a881b75aeaed6605ad4a2
-
SSDEEP
3072:HGbxOHXYuUc16oos6SppvjvA12pYFguU6k3N1VVQDJJ7wkJseHBSO5weBsfFOY:HkxO3c2zdvA12eCuUJDQl5wheHBd59BI
Static task
static1
Behavioral task
behavioral1
Sample
8bddb10753bd54d5d10e9a2c5b3598060f86c2320833689bbbf396f18ecaa297.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
8bddb10753bd54d5d10e9a2c5b3598060f86c2320833689bbbf396f18ecaa297.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
@naralust2
94.142.138.4:80
-
auth_value
684687f1439152a73e2a8b293ee8c64e
Targets
-
-
Target
8bddb10753bd54d5d10e9a2c5b3598060f86c2320833689bbbf396f18ecaa297.exe
-
Size
254KB
-
MD5
02e01f99331d49d6c0b7924b1b004d63
-
SHA1
eac10a46befefae9269e64ce0f20dfb3e05207eb
-
SHA256
8bddb10753bd54d5d10e9a2c5b3598060f86c2320833689bbbf396f18ecaa297
-
SHA512
9f3549c9779488ec6aaf6602aea6c8323eae1585a819f3c00c87b61cf0e77a6f34d01bd7f7cba3bb638e040c87e9d92c4f515a9c27b553c7cf7a4eb2bfa0c229
-
SSDEEP
6144:03dJeJ+9HPGKFHdx2a1NCinscgyVIfof38:03neJQPGUG8IinszLQfs
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-