General
-
Target
ca2d577457b10f0e9c6a1f0777e1bd3241cd1ea3dfd65cf2ebf1151ceb7c84a6
-
Size
764KB
-
Sample
230526-neebpafb74
-
MD5
09bcd36e99ee0ea8a1c1802cfb4cdc29
-
SHA1
aaf64fd2e139d995669e8409efe7b503483cc1cf
-
SHA256
ca2d577457b10f0e9c6a1f0777e1bd3241cd1ea3dfd65cf2ebf1151ceb7c84a6
-
SHA512
f1c281741494901672ee06aa08c1b71ca066a5154b9a1c611235861ca3597a59b1296fb3cdbd9a9ca8a5242874eb639fe0f7a9a18af568bb194a931a408f42df
-
SSDEEP
12288:fMrcy90Pw16Mo6BIkoMtkVHFBLHzzN3khWIFidcvNMGq+4dBHmd/LBQEUlani:fyKrkyFdShWmiWGGp4fHmdDsUni
Static task
static1
Behavioral task
behavioral1
Sample
ca2d577457b10f0e9c6a1f0777e1bd3241cd1ea3dfd65cf2ebf1151ceb7c84a6.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
disa
83.97.73.122:19062
-
auth_value
93f8c4ca7000e3381dd4b6b86434de05
Extracted
redline
goga
83.97.73.122:19062
-
auth_value
6d57dff6d3c42dddb8a76dc276b8467f
Targets
-
-
Target
ca2d577457b10f0e9c6a1f0777e1bd3241cd1ea3dfd65cf2ebf1151ceb7c84a6
-
Size
764KB
-
MD5
09bcd36e99ee0ea8a1c1802cfb4cdc29
-
SHA1
aaf64fd2e139d995669e8409efe7b503483cc1cf
-
SHA256
ca2d577457b10f0e9c6a1f0777e1bd3241cd1ea3dfd65cf2ebf1151ceb7c84a6
-
SHA512
f1c281741494901672ee06aa08c1b71ca066a5154b9a1c611235861ca3597a59b1296fb3cdbd9a9ca8a5242874eb639fe0f7a9a18af568bb194a931a408f42df
-
SSDEEP
12288:fMrcy90Pw16Mo6BIkoMtkVHFBLHzzN3khWIFidcvNMGq+4dBHmd/LBQEUlani:fyKrkyFdShWmiWGGp4fHmdDsUni
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-