General
-
Target
c7ea9dba8f507b134e310904b37ddc06933633da8a802be2e7eff2bef887dddd
-
Size
1.1MB
-
Sample
230514-t8a41sce26
-
MD5
04115d51a5db91c2c69491e915085fb0
-
SHA1
22eb62ac14bc6cfe6c8fa1a9d769533bf589525a
-
SHA256
c7ea9dba8f507b134e310904b37ddc06933633da8a802be2e7eff2bef887dddd
-
SHA512
46b273acb4a531acd3c74b81905612fe05a50980b19594df3679f9eebd3b18dc703d21dfb39a3eed6744c86f386558e9fa41982045b200108055128c537f3a23
-
SSDEEP
24576:IycfnGNZBL3U51XHhkXZqLr9xtsiBBuQkMYFEqufzS+bMo8:Pcfn+kHXHdLbCHM17foo
Static task
static1
Behavioral task
behavioral1
Sample
c7ea9dba8f507b134e310904b37ddc06933633da8a802be2e7eff2bef887dddd.exe
Resource
win10-20230220-en
Malware Config
Extracted
redline
messi
185.161.248.75:4132
-
auth_value
b602b28664bb738e322d37baab91db28
Extracted
redline
warum
185.161.248.75:4132
-
auth_value
0bdb2dda91dadc65f555dee088a6a2a4
Targets
-
-
Target
c7ea9dba8f507b134e310904b37ddc06933633da8a802be2e7eff2bef887dddd
-
Size
1.1MB
-
MD5
04115d51a5db91c2c69491e915085fb0
-
SHA1
22eb62ac14bc6cfe6c8fa1a9d769533bf589525a
-
SHA256
c7ea9dba8f507b134e310904b37ddc06933633da8a802be2e7eff2bef887dddd
-
SHA512
46b273acb4a531acd3c74b81905612fe05a50980b19594df3679f9eebd3b18dc703d21dfb39a3eed6744c86f386558e9fa41982045b200108055128c537f3a23
-
SSDEEP
24576:IycfnGNZBL3U51XHhkXZqLr9xtsiBBuQkMYFEqufzS+bMo8:Pcfn+kHXHdLbCHM17foo
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-