General
-
Target
26ce223fd8816f0f996f9edaf60c4429b2a89defcb76ddce8ff3de338272e8d9
-
Size
1.1MB
-
Sample
230514-11ntgaga4t
-
MD5
86a791a30d82c50ae0e86912324cd089
-
SHA1
c3f4889cde3fce623651b9bf3b574ce58da2eaf8
-
SHA256
26ce223fd8816f0f996f9edaf60c4429b2a89defcb76ddce8ff3de338272e8d9
-
SHA512
3d9cddfd54144da8c519acbc2f663ce1ec0666d5569ea2b51a5fc1801cf10fd317102d15184bfd5b537092744a494ea83ba70aceff1bdbe647009ecb3d429fbd
-
SSDEEP
24576:wyI78Z/Q5mBhIVRysq+MIQw1tXOzv+XyKrt85yBLAch:3q7OhgyL+MIQw1tXAvIxrt8I
Static task
static1
Behavioral task
behavioral1
Sample
26ce223fd8816f0f996f9edaf60c4429b2a89defcb76ddce8ff3de338272e8d9.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
linda
185.161.248.75:4132
-
auth_value
21cdc21d041667b9c1679f88a1146770
Extracted
redline
horor
185.161.248.75:4132
-
auth_value
b8d506fe48db15c38fb031d07f42d529
Targets
-
-
Target
26ce223fd8816f0f996f9edaf60c4429b2a89defcb76ddce8ff3de338272e8d9
-
Size
1.1MB
-
MD5
86a791a30d82c50ae0e86912324cd089
-
SHA1
c3f4889cde3fce623651b9bf3b574ce58da2eaf8
-
SHA256
26ce223fd8816f0f996f9edaf60c4429b2a89defcb76ddce8ff3de338272e8d9
-
SHA512
3d9cddfd54144da8c519acbc2f663ce1ec0666d5569ea2b51a5fc1801cf10fd317102d15184bfd5b537092744a494ea83ba70aceff1bdbe647009ecb3d429fbd
-
SSDEEP
24576:wyI78Z/Q5mBhIVRysq+MIQw1tXOzv+XyKrt85yBLAch:3q7OhgyL+MIQw1tXAvIxrt8I
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-