General
-
Target
5c37be0332359367e1aaaf6976848edea45dced2e170b2750df1bd7c2c051a17
-
Size
1.1MB
-
Sample
230514-z39chsfh3z
-
MD5
f9771ce7a3968bfd4896ad83fcbc4fde
-
SHA1
f554541c528a0fcd4b9ee3793f20a02de5afb50a
-
SHA256
5c37be0332359367e1aaaf6976848edea45dced2e170b2750df1bd7c2c051a17
-
SHA512
0cbdbfc8ce10d0b4d6b2ff65ff8fa43a93cd37e51ff8771538acf74e4b3350877e7563ad914dd48a0366f1b5b6ca3df1b43cd0c7c405225fb550a0e4581ed84f
-
SSDEEP
24576:9y9YMSy+ubPGgDbzT3N6vuA93weAwjM4sJmC/8P/Se:YCyXPTDPT3IvuA9P7sJmeM
Static task
static1
Behavioral task
behavioral1
Sample
5c37be0332359367e1aaaf6976848edea45dced2e170b2750df1bd7c2c051a17.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
linda
185.161.248.75:4132
-
auth_value
21cdc21d041667b9c1679f88a1146770
Extracted
redline
horor
185.161.248.75:4132
-
auth_value
b8d506fe48db15c38fb031d07f42d529
Targets
-
-
Target
5c37be0332359367e1aaaf6976848edea45dced2e170b2750df1bd7c2c051a17
-
Size
1.1MB
-
MD5
f9771ce7a3968bfd4896ad83fcbc4fde
-
SHA1
f554541c528a0fcd4b9ee3793f20a02de5afb50a
-
SHA256
5c37be0332359367e1aaaf6976848edea45dced2e170b2750df1bd7c2c051a17
-
SHA512
0cbdbfc8ce10d0b4d6b2ff65ff8fa43a93cd37e51ff8771538acf74e4b3350877e7563ad914dd48a0366f1b5b6ca3df1b43cd0c7c405225fb550a0e4581ed84f
-
SSDEEP
24576:9y9YMSy+ubPGgDbzT3N6vuA93weAwjM4sJmC/8P/Se:YCyXPTDPT3IvuA9P7sJmeM
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-