General
-
Target
f300bcfb7c33e8650bc2aedf84c0a0749e08b20b8bf113b7df147b1b74e7b5a5.exe
-
Size
1.1MB
-
Sample
230514-xa3cdsfc7v
-
MD5
9745fd82760353ed7d3968a1d8455f0a
-
SHA1
73bd45255c380fb5e8d3beb8542d326237cf74fd
-
SHA256
f300bcfb7c33e8650bc2aedf84c0a0749e08b20b8bf113b7df147b1b74e7b5a5
-
SHA512
90d72f0a11c4d83eb3eed05c4fc630baef4843dce2f4acd44bcc811456675dfa2a0b2d52d9373d509623f8ee31196594bdeda39a8dd5d341722e6460b3c45a77
-
SSDEEP
24576:CydmUm5f/1zvdXD17l7rDRyIs5bgvZcX/QQ7TNF35Jpu:pdmUm5f/tFz1hnFhs5+WX/QQZJ
Static task
static1
Behavioral task
behavioral1
Sample
f300bcfb7c33e8650bc2aedf84c0a0749e08b20b8bf113b7df147b1b74e7b5a5.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
f300bcfb7c33e8650bc2aedf84c0a0749e08b20b8bf113b7df147b1b74e7b5a5.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
motor
185.161.248.75:4132
-
auth_value
ec19ab9989a783983c5cbbc0e5ac4a5f
Extracted
redline
terra
185.161.248.75:4132
-
auth_value
60df3f535f8aa4e264f78041983592d2
Targets
-
-
Target
f300bcfb7c33e8650bc2aedf84c0a0749e08b20b8bf113b7df147b1b74e7b5a5.exe
-
Size
1.1MB
-
MD5
9745fd82760353ed7d3968a1d8455f0a
-
SHA1
73bd45255c380fb5e8d3beb8542d326237cf74fd
-
SHA256
f300bcfb7c33e8650bc2aedf84c0a0749e08b20b8bf113b7df147b1b74e7b5a5
-
SHA512
90d72f0a11c4d83eb3eed05c4fc630baef4843dce2f4acd44bcc811456675dfa2a0b2d52d9373d509623f8ee31196594bdeda39a8dd5d341722e6460b3c45a77
-
SSDEEP
24576:CydmUm5f/1zvdXD17l7rDRyIs5bgvZcX/QQ7TNF35Jpu:pdmUm5f/tFz1hnFhs5+WX/QQZJ
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-