General
-
Target
1d2a44643f2ecd66a94008ce74aeb353a021bb82daa2247c4368d9c9c4edbdef
-
Size
1.1MB
-
Sample
230514-z92w1sdf55
-
MD5
11420bf8778912ce41f613329dfac8dd
-
SHA1
8a415eeaf01672e8007d3499ef274c41f7440d5c
-
SHA256
1d2a44643f2ecd66a94008ce74aeb353a021bb82daa2247c4368d9c9c4edbdef
-
SHA512
ab1615e9bbfcf7fe20341d52300dd1683a2af321337eedb3a67efd81df862c437ccfe27676c755de0da9c65baf1c3c1c0b83dae71c450be1ed3d2ec99bee893b
-
SSDEEP
24576:GyJOlbzgG3Lji9E2lSl9t00TX3MFpr9EkrM8jOA1Bm5gvKpbeyBsz:VJoMly9q2neUoMcxm5gCp9
Static task
static1
Behavioral task
behavioral1
Sample
1d2a44643f2ecd66a94008ce74aeb353a021bb82daa2247c4368d9c9c4edbdef.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
redline
linda
185.161.248.75:4132
-
auth_value
21cdc21d041667b9c1679f88a1146770
Extracted
redline
horor
185.161.248.75:4132
-
auth_value
b8d506fe48db15c38fb031d07f42d529
Targets
-
-
Target
1d2a44643f2ecd66a94008ce74aeb353a021bb82daa2247c4368d9c9c4edbdef
-
Size
1.1MB
-
MD5
11420bf8778912ce41f613329dfac8dd
-
SHA1
8a415eeaf01672e8007d3499ef274c41f7440d5c
-
SHA256
1d2a44643f2ecd66a94008ce74aeb353a021bb82daa2247c4368d9c9c4edbdef
-
SHA512
ab1615e9bbfcf7fe20341d52300dd1683a2af321337eedb3a67efd81df862c437ccfe27676c755de0da9c65baf1c3c1c0b83dae71c450be1ed3d2ec99bee893b
-
SSDEEP
24576:GyJOlbzgG3Lji9E2lSl9t00TX3MFpr9EkrM8jOA1Bm5gvKpbeyBsz:VJoMly9q2neUoMcxm5gCp9
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-