General
-
Target
1fd79dbcff6d0748f7e91e9fdc304838992b81dc1bc665336facc3e3b7007652
-
Size
1.1MB
-
Sample
230514-zgqy2sfg7s
-
MD5
168fa4081fb3d96460dc64495fe0f482
-
SHA1
79fd0a38c6b6aef10f669cc88df04ef7376de1cc
-
SHA256
1fd79dbcff6d0748f7e91e9fdc304838992b81dc1bc665336facc3e3b7007652
-
SHA512
f4b71fc7ab93771c3821c7aed1390b2fca140bc36dcc7bec467e507adcc0fcbd7b47a927676f72d0c4da9b4ab3cdd1fe9e8945ca598a63bef1f98a9434a7312c
-
SSDEEP
24576:xyFXGrPNAId9oPq9qkMjkGfBjTn0dLuYSYgCULw15frDN:kk7CU9Z9+jkGfquYSYgV015jD
Static task
static1
Behavioral task
behavioral1
Sample
1fd79dbcff6d0748f7e91e9fdc304838992b81dc1bc665336facc3e3b7007652.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
linda
185.161.248.75:4132
-
auth_value
21cdc21d041667b9c1679f88a1146770
Extracted
redline
horor
185.161.248.75:4132
-
auth_value
b8d506fe48db15c38fb031d07f42d529
Targets
-
-
Target
1fd79dbcff6d0748f7e91e9fdc304838992b81dc1bc665336facc3e3b7007652
-
Size
1.1MB
-
MD5
168fa4081fb3d96460dc64495fe0f482
-
SHA1
79fd0a38c6b6aef10f669cc88df04ef7376de1cc
-
SHA256
1fd79dbcff6d0748f7e91e9fdc304838992b81dc1bc665336facc3e3b7007652
-
SHA512
f4b71fc7ab93771c3821c7aed1390b2fca140bc36dcc7bec467e507adcc0fcbd7b47a927676f72d0c4da9b4ab3cdd1fe9e8945ca598a63bef1f98a9434a7312c
-
SSDEEP
24576:xyFXGrPNAId9oPq9qkMjkGfBjTn0dLuYSYgCULw15frDN:kk7CU9Z9+jkGfquYSYgV015jD
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-