General
-
Target
a2e44fa111836d5614bb651559d6802af2964f68df87c0022515ca5527f724fc
-
Size
1.1MB
-
Sample
230514-1d1jradf67
-
MD5
290ca119da7e92e309d99b20599301ae
-
SHA1
2e31168412dfea90667318fa74798afab5709dc9
-
SHA256
a2e44fa111836d5614bb651559d6802af2964f68df87c0022515ca5527f724fc
-
SHA512
b83148836c5144128f22eb2c72f3017834867dcdc0fdf5318349cf64e4b9af909401473c983db7fb35709034a1f33ef7088d7220a6573f94af457f9acc195113
-
SSDEEP
24576:ryd7aqovTsG57m0nXZo6hFKjG+8FQe+VjWDaOu5r5cx:ed7aqov4n0XZvhFKrUQeCWDaLr5c
Static task
static1
Behavioral task
behavioral1
Sample
a2e44fa111836d5614bb651559d6802af2964f68df87c0022515ca5527f724fc.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
linda
185.161.248.75:4132
-
auth_value
21cdc21d041667b9c1679f88a1146770
Extracted
redline
horor
185.161.248.75:4132
-
auth_value
b8d506fe48db15c38fb031d07f42d529
Targets
-
-
Target
a2e44fa111836d5614bb651559d6802af2964f68df87c0022515ca5527f724fc
-
Size
1.1MB
-
MD5
290ca119da7e92e309d99b20599301ae
-
SHA1
2e31168412dfea90667318fa74798afab5709dc9
-
SHA256
a2e44fa111836d5614bb651559d6802af2964f68df87c0022515ca5527f724fc
-
SHA512
b83148836c5144128f22eb2c72f3017834867dcdc0fdf5318349cf64e4b9af909401473c983db7fb35709034a1f33ef7088d7220a6573f94af457f9acc195113
-
SSDEEP
24576:ryd7aqovTsG57m0nXZo6hFKjG+8FQe+VjWDaOu5r5cx:ed7aqov4n0XZvhFKrUQeCWDaLr5c
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-