General
-
Target
6b5504f48853d941637b1dab1dd6ffcb19ce619fe9d1b2332d829c47aefcbd8b
-
Size
1.0MB
-
Sample
230526-l9gn7afe2w
-
MD5
53741256b56f0a2ff9fe41603c8be5f3
-
SHA1
fa9f948d93983595e2b10b988962b94606dc4273
-
SHA256
6b5504f48853d941637b1dab1dd6ffcb19ce619fe9d1b2332d829c47aefcbd8b
-
SHA512
cf6ed85de1d021a4b570503851a0759ec6407dcabc26025612bf10931b4b0268e621e40214dec52b3718dbde1505807516644f7f1c569b4a341b7a9cb5fb2f57
-
SSDEEP
24576:7yDvTp7V9gbjru4G/ZhX4Ktmd05reXNbUoBkWvSl:u1Vybjrkrptmd0UUMkWv
Static task
static1
Behavioral task
behavioral1
Sample
6b5504f48853d941637b1dab1dd6ffcb19ce619fe9d1b2332d829c47aefcbd8b.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
lisa
83.97.73.122:19062
-
auth_value
c2dc311db9820012377b054447d37949
Extracted
redline
goga
83.97.73.122:19062
-
auth_value
6d57dff6d3c42dddb8a76dc276b8467f
Targets
-
-
Target
6b5504f48853d941637b1dab1dd6ffcb19ce619fe9d1b2332d829c47aefcbd8b
-
Size
1.0MB
-
MD5
53741256b56f0a2ff9fe41603c8be5f3
-
SHA1
fa9f948d93983595e2b10b988962b94606dc4273
-
SHA256
6b5504f48853d941637b1dab1dd6ffcb19ce619fe9d1b2332d829c47aefcbd8b
-
SHA512
cf6ed85de1d021a4b570503851a0759ec6407dcabc26025612bf10931b4b0268e621e40214dec52b3718dbde1505807516644f7f1c569b4a341b7a9cb5fb2f57
-
SSDEEP
24576:7yDvTp7V9gbjru4G/ZhX4Ktmd05reXNbUoBkWvSl:u1Vybjrkrptmd0UUMkWv
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-