General
-
Target
4dbe6182622d332e534128c464b20a743fa03f24601eab58d24eb4ec8a680216
-
Size
1.0MB
-
Sample
230526-lbnd3sfc8v
-
MD5
5dcf8e8be96c59eba8fba9ba5e90e1f2
-
SHA1
815382501b16ac6eff4154e0408cdada93a8d80e
-
SHA256
4dbe6182622d332e534128c464b20a743fa03f24601eab58d24eb4ec8a680216
-
SHA512
7df282ac09df7f70294ef93610a4fa74d4ea4439bdc9f8cfc0b56a86d90a275e2abc20b9ad845a87e5c0b3237212a840509bd4078a12c64d105913140590fae3
-
SSDEEP
24576:AyeKn5qh8YjBthXC93vzs4Cmmd5bjZmSidcIhH0N/agrOfS19e:Hz5ZYXhS9/zimmd5XMtdcoiag0W
Static task
static1
Behavioral task
behavioral1
Sample
4dbe6182622d332e534128c464b20a743fa03f24601eab58d24eb4ec8a680216.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
lisa
83.97.73.122:19062
-
auth_value
c2dc311db9820012377b054447d37949
Extracted
redline
goga
83.97.73.122:19062
-
auth_value
6d57dff6d3c42dddb8a76dc276b8467f
Targets
-
-
Target
4dbe6182622d332e534128c464b20a743fa03f24601eab58d24eb4ec8a680216
-
Size
1.0MB
-
MD5
5dcf8e8be96c59eba8fba9ba5e90e1f2
-
SHA1
815382501b16ac6eff4154e0408cdada93a8d80e
-
SHA256
4dbe6182622d332e534128c464b20a743fa03f24601eab58d24eb4ec8a680216
-
SHA512
7df282ac09df7f70294ef93610a4fa74d4ea4439bdc9f8cfc0b56a86d90a275e2abc20b9ad845a87e5c0b3237212a840509bd4078a12c64d105913140590fae3
-
SSDEEP
24576:AyeKn5qh8YjBthXC93vzs4Cmmd5bjZmSidcIhH0N/agrOfS19e:Hz5ZYXhS9/zimmd5XMtdcoiag0W
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-