General
-
Target
validator.dll.exe
-
Size
12KB
-
Sample
230517-ncc1vadg9s
-
MD5
03c3f979feffbf02e7ab9a66f9a1f7b4
-
SHA1
826e5038b32c3975821eb8641e484b575fdfa7e9
-
SHA256
f746b0a6d47ddc6b6a03d78a7dca6e61bbb32a35cdf89073cd245eb4662cfbfd
-
SHA512
14451960a5e111d44d58e0660a0d5f1dfcae74046fd595d6e8f758c0d01181141201af0813425e571f2296b9cab2ed314ac2a65d1ba139d4deaf6180b5e9a8ea
-
SSDEEP
192:wMJ0X7yZWu7s3+7DBPSVcWF28A6lJGNyQK+NAA5yQ03826p:wvLygTO7D4qWF28bJHQllm6
Static task
static1
Behavioral task
behavioral1
Sample
validator.dll.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
validator.dll.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
Love Fi Lo
111.90.149.195:55186
Targets
-
-
Target
validator.dll.exe
-
Size
12KB
-
MD5
03c3f979feffbf02e7ab9a66f9a1f7b4
-
SHA1
826e5038b32c3975821eb8641e484b575fdfa7e9
-
SHA256
f746b0a6d47ddc6b6a03d78a7dca6e61bbb32a35cdf89073cd245eb4662cfbfd
-
SHA512
14451960a5e111d44d58e0660a0d5f1dfcae74046fd595d6e8f758c0d01181141201af0813425e571f2296b9cab2ed314ac2a65d1ba139d4deaf6180b5e9a8ea
-
SSDEEP
192:wMJ0X7yZWu7s3+7DBPSVcWF28A6lJGNyQK+NAA5yQ03826p:wvLygTO7D4qWF28bJHQllm6
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SectopRAT payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-