General
-
Target
BloxFruits GUI.exe
-
Size
327KB
-
Sample
230523-zqpgksac5s
-
MD5
79e2287c7f1e3b6b62a80c994d46c3a7
-
SHA1
cf71a4e8f88c7a23d9074a6cc3ca3bb0d58ef895
-
SHA256
bdc9362777d3cbbdd3362b62e48e4b2dc053f1dc1b8e4e1ef9b1b666e4efd05a
-
SHA512
e4ea76a5fda839c6812bca5c8d0dbbfc72a72242a5dd7e57ee70d54ad89b2355891e6e8adfe62d8c36b901c5f9bfc7fe8ae12ac4b9adc8faad67a788ce2c74f2
-
SSDEEP
6144:bV9SHeF45XiiPTwH0iE4SHt8laYNqHpwW2DtTKh8:bvieF45S5H0i3SHClaYNqHEZ
Static task
static1
Behavioral task
behavioral1
Sample
BloxFruits GUI.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
BloxFruits GUI.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
45.15.156.170:43588
-
auth_value
9c8dd7353be7ed4b6832da21d8d0d902
Targets
-
-
Target
BloxFruits GUI.exe
-
Size
327KB
-
MD5
79e2287c7f1e3b6b62a80c994d46c3a7
-
SHA1
cf71a4e8f88c7a23d9074a6cc3ca3bb0d58ef895
-
SHA256
bdc9362777d3cbbdd3362b62e48e4b2dc053f1dc1b8e4e1ef9b1b666e4efd05a
-
SHA512
e4ea76a5fda839c6812bca5c8d0dbbfc72a72242a5dd7e57ee70d54ad89b2355891e6e8adfe62d8c36b901c5f9bfc7fe8ae12ac4b9adc8faad67a788ce2c74f2
-
SSDEEP
6144:bV9SHeF45XiiPTwH0iE4SHt8laYNqHpwW2DtTKh8:bvieF45S5H0i3SHClaYNqHEZ
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-