General
-
Target
9123e1d5ce36850553013ce543c95697976e9506d542ae8433975162e718d402
-
Size
1.0MB
-
Sample
230526-ptxbgsfe54
-
MD5
276f97368dee70b2fcf750b4dd0f1209
-
SHA1
427b46b61d385ebdc4bf73dd2d9a3ae7c3ff3917
-
SHA256
9123e1d5ce36850553013ce543c95697976e9506d542ae8433975162e718d402
-
SHA512
e19071de4c2e4d09cc37a1a8c97f58f56fcc84dd6e40262d326ab763c381732109015869dc9b8c6fcb653a4d88ebbf589b6bef6302705c56cc45b195e3cb8308
-
SSDEEP
24576:uyObO6ZMxVt/Wpmd6avqYh8qcegqws7RA:9yO6qVt/Wpmd6aiY8ejwq
Static task
static1
Behavioral task
behavioral1
Sample
9123e1d5ce36850553013ce543c95697976e9506d542ae8433975162e718d402.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
lisa
83.97.73.122:19062
-
auth_value
c2dc311db9820012377b054447d37949
Extracted
redline
goga
83.97.73.122:19062
-
auth_value
6d57dff6d3c42dddb8a76dc276b8467f
Targets
-
-
Target
9123e1d5ce36850553013ce543c95697976e9506d542ae8433975162e718d402
-
Size
1.0MB
-
MD5
276f97368dee70b2fcf750b4dd0f1209
-
SHA1
427b46b61d385ebdc4bf73dd2d9a3ae7c3ff3917
-
SHA256
9123e1d5ce36850553013ce543c95697976e9506d542ae8433975162e718d402
-
SHA512
e19071de4c2e4d09cc37a1a8c97f58f56fcc84dd6e40262d326ab763c381732109015869dc9b8c6fcb653a4d88ebbf589b6bef6302705c56cc45b195e3cb8308
-
SSDEEP
24576:uyObO6ZMxVt/Wpmd6avqYh8qcegqws7RA:9yO6qVt/Wpmd6aiY8ejwq
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-