General
-
Target
e0d062023899390702555273710cd103c5edb6b65337a5a186a49d02947dd587
-
Size
1.1MB
-
Sample
230514-zvb22sde97
-
MD5
68d63280acab85684bc867e82e58df94
-
SHA1
b98b31112937732fb553153cecb5ab158a5ae60e
-
SHA256
e0d062023899390702555273710cd103c5edb6b65337a5a186a49d02947dd587
-
SHA512
9cd03c79d3ea5d322c83fa1a081a96023837dde44eb8bee2eaf9baaef4aaf692977ddb28e15250c3066ec01363d434ccae14737e38b2d5236d8bfa4fdcbf9b79
-
SSDEEP
24576:5yqX0JWXPniD5c5Tm4TAT5xt4nhbCddfRpTgQR7HtljpB:s+0gXY5sUTsKJHv
Static task
static1
Behavioral task
behavioral1
Sample
e0d062023899390702555273710cd103c5edb6b65337a5a186a49d02947dd587.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
linda
185.161.248.75:4132
-
auth_value
21cdc21d041667b9c1679f88a1146770
Extracted
redline
horor
185.161.248.75:4132
-
auth_value
b8d506fe48db15c38fb031d07f42d529
Targets
-
-
Target
e0d062023899390702555273710cd103c5edb6b65337a5a186a49d02947dd587
-
Size
1.1MB
-
MD5
68d63280acab85684bc867e82e58df94
-
SHA1
b98b31112937732fb553153cecb5ab158a5ae60e
-
SHA256
e0d062023899390702555273710cd103c5edb6b65337a5a186a49d02947dd587
-
SHA512
9cd03c79d3ea5d322c83fa1a081a96023837dde44eb8bee2eaf9baaef4aaf692977ddb28e15250c3066ec01363d434ccae14737e38b2d5236d8bfa4fdcbf9b79
-
SSDEEP
24576:5yqX0JWXPniD5c5Tm4TAT5xt4nhbCddfRpTgQR7HtljpB:s+0gXY5sUTsKJHv
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-