General
-
Target
a909c947cde32294b98a1cb571302ad4fef011395cf127c0636a206a01b1b2b3
-
Size
764KB
-
Sample
230526-m8kvwsff5w
-
MD5
ae4ccba7813a4b15185b05e396419f86
-
SHA1
88f9ca1159e33489fcbdfca354078b0ebe5ee994
-
SHA256
a909c947cde32294b98a1cb571302ad4fef011395cf127c0636a206a01b1b2b3
-
SHA512
ad62b478dd00cb6298bfcca2829a8a5316a1d34cb6fadb3d0941733c11fe652e5228efaff2560cf30be324e1584caa0cc8bdec8729c71411502c3d2eb9f92c7a
-
SSDEEP
12288:oMr3y90gZuYxSg1QOfvIRzEzD84kCMNE90T4ISi7II4dfvmdQLBFEUxn:fylIgNWzqD2CMN5T39794tvmdUTxn
Static task
static1
Behavioral task
behavioral1
Sample
a909c947cde32294b98a1cb571302ad4fef011395cf127c0636a206a01b1b2b3.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
disa
83.97.73.122:19062
-
auth_value
93f8c4ca7000e3381dd4b6b86434de05
Extracted
redline
goga
83.97.73.122:19062
-
auth_value
6d57dff6d3c42dddb8a76dc276b8467f
Targets
-
-
Target
a909c947cde32294b98a1cb571302ad4fef011395cf127c0636a206a01b1b2b3
-
Size
764KB
-
MD5
ae4ccba7813a4b15185b05e396419f86
-
SHA1
88f9ca1159e33489fcbdfca354078b0ebe5ee994
-
SHA256
a909c947cde32294b98a1cb571302ad4fef011395cf127c0636a206a01b1b2b3
-
SHA512
ad62b478dd00cb6298bfcca2829a8a5316a1d34cb6fadb3d0941733c11fe652e5228efaff2560cf30be324e1584caa0cc8bdec8729c71411502c3d2eb9f92c7a
-
SSDEEP
12288:oMr3y90gZuYxSg1QOfvIRzEzD84kCMNE90T4ISi7II4dfvmdQLBFEUxn:fylIgNWzqD2CMN5T39794tvmdUTxn
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-