General
-
Target
61ae2976792c032d5d802008d24ac795cbaa24978312958714eaf8db5f03054e
-
Size
1.1MB
-
Sample
230514-jnddjadd9x
-
MD5
f1599b9018ad90da57ebee58f6f3583a
-
SHA1
35881374f98f1c3a89947dbcd3dd8f8813cc4d46
-
SHA256
61ae2976792c032d5d802008d24ac795cbaa24978312958714eaf8db5f03054e
-
SHA512
adec4d8dfdf9b896a2569598113110fc1cc029ce06056d804574a93bfb711c37364dc24026e840ffa3f17d547df82bb7d2f01a0b6a3bde8669e79a7b2b901280
-
SSDEEP
24576:rylGN0d7bpJkUq8udVmnVZlnt3X/fYTJz0QlOWO/Q2OcTr60Af:edd7rkUodYnVZlVIyQla/Qcr
Static task
static1
Behavioral task
behavioral1
Sample
61ae2976792c032d5d802008d24ac795cbaa24978312958714eaf8db5f03054e.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
luka
185.161.248.75:4132
-
auth_value
44560bcd37d6bf076da309730fdb519a
Extracted
redline
terra
185.161.248.75:4132
-
auth_value
60df3f535f8aa4e264f78041983592d2
Targets
-
-
Target
61ae2976792c032d5d802008d24ac795cbaa24978312958714eaf8db5f03054e
-
Size
1.1MB
-
MD5
f1599b9018ad90da57ebee58f6f3583a
-
SHA1
35881374f98f1c3a89947dbcd3dd8f8813cc4d46
-
SHA256
61ae2976792c032d5d802008d24ac795cbaa24978312958714eaf8db5f03054e
-
SHA512
adec4d8dfdf9b896a2569598113110fc1cc029ce06056d804574a93bfb711c37364dc24026e840ffa3f17d547df82bb7d2f01a0b6a3bde8669e79a7b2b901280
-
SSDEEP
24576:rylGN0d7bpJkUq8udVmnVZlnt3X/fYTJz0QlOWO/Q2OcTr60Af:edd7rkUodYnVZlVIyQla/Qcr
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-