General
-
Target
859a0bdd41feefd3a8a0b524e71cd82ff7a20302e8899324737055eb9199e22f
-
Size
764KB
-
Sample
230526-ngp6zaff71
-
MD5
d87dec55b75cd3c59ce5bfb862c3c35a
-
SHA1
630819939bb2666d713b4d2d3c40fd9293389d69
-
SHA256
859a0bdd41feefd3a8a0b524e71cd82ff7a20302e8899324737055eb9199e22f
-
SHA512
59832d17ffaeab837c5205779f17ab216744640397b57b18e0799e33a8f2c52cce2710527bfe6bc015620fa5169149440f877c7afa3bcaa45c4128c8c085a1c9
-
SSDEEP
12288:AMr4y90OvR1qcEMTV8kbgWgpxxKr+5ZVxqGIq+4dBtmd/LBXEtd:oyn3Hbg//IMrLIp4ftmdDUd
Static task
static1
Behavioral task
behavioral1
Sample
859a0bdd41feefd3a8a0b524e71cd82ff7a20302e8899324737055eb9199e22f.exe
Resource
win10-20230220-en
Malware Config
Extracted
redline
misa
83.97.73.122:19062
-
auth_value
9e79529a6bdb4962f44d12b0d6d62d32
Extracted
redline
goga
83.97.73.122:19062
-
auth_value
6d57dff6d3c42dddb8a76dc276b8467f
Targets
-
-
Target
859a0bdd41feefd3a8a0b524e71cd82ff7a20302e8899324737055eb9199e22f
-
Size
764KB
-
MD5
d87dec55b75cd3c59ce5bfb862c3c35a
-
SHA1
630819939bb2666d713b4d2d3c40fd9293389d69
-
SHA256
859a0bdd41feefd3a8a0b524e71cd82ff7a20302e8899324737055eb9199e22f
-
SHA512
59832d17ffaeab837c5205779f17ab216744640397b57b18e0799e33a8f2c52cce2710527bfe6bc015620fa5169149440f877c7afa3bcaa45c4128c8c085a1c9
-
SSDEEP
12288:AMr4y90OvR1qcEMTV8kbgWgpxxKr+5ZVxqGIq+4dBtmd/LBXEtd:oyn3Hbg//IMrLIp4ftmdDUd
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-