General
-
Target
e803bd0651356bfa4b71e63ffb2cd9d83c00ea2ef6d35ed84ad8783c162c955c.exe
-
Size
1.1MB
-
Sample
230514-xaablsda76
-
MD5
239912f28c90f9c21e6a2c50ee476308
-
SHA1
a721c6aff9b6959c217575636f7dea282ca61dce
-
SHA256
e803bd0651356bfa4b71e63ffb2cd9d83c00ea2ef6d35ed84ad8783c162c955c
-
SHA512
e0fd48c9cecc7dd00005038cc9862752bc8ba0fc4c23d7a1d5f6424f511422d9e8e2aa768b4c926c7cab1d1f0b3786e0b7a67ed12b39751e7f9f73e05ab2b90f
-
SSDEEP
24576:nyGsjZoUAYSwffwo2kLI9+bkmdbTlkIsD1lf2HC/u6h+EAb7w:ynjZWYSw3woicbLdbRNsTfa6h+P
Static task
static1
Behavioral task
behavioral1
Sample
e803bd0651356bfa4b71e63ffb2cd9d83c00ea2ef6d35ed84ad8783c162c955c.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
e803bd0651356bfa4b71e63ffb2cd9d83c00ea2ef6d35ed84ad8783c162c955c.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
dogma
185.161.248.75:4132
-
auth_value
d6c5d36e9aa03c956dc76aa0fcbe3639
Extracted
redline
terra
185.161.248.75:4132
-
auth_value
60df3f535f8aa4e264f78041983592d2
Targets
-
-
Target
e803bd0651356bfa4b71e63ffb2cd9d83c00ea2ef6d35ed84ad8783c162c955c.exe
-
Size
1.1MB
-
MD5
239912f28c90f9c21e6a2c50ee476308
-
SHA1
a721c6aff9b6959c217575636f7dea282ca61dce
-
SHA256
e803bd0651356bfa4b71e63ffb2cd9d83c00ea2ef6d35ed84ad8783c162c955c
-
SHA512
e0fd48c9cecc7dd00005038cc9862752bc8ba0fc4c23d7a1d5f6424f511422d9e8e2aa768b4c926c7cab1d1f0b3786e0b7a67ed12b39751e7f9f73e05ab2b90f
-
SSDEEP
24576:nyGsjZoUAYSwffwo2kLI9+bkmdbTlkIsD1lf2HC/u6h+EAb7w:ynjZWYSw3woicbLdbRNsTfa6h+P
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-