General
-
Target
4c3f07e19fa39ee97fe42dcc8d737054693af6610536d4267d21a17665c3df60
-
Size
1.0MB
-
Sample
230526-se18nsga65
-
MD5
3cf31a2bb8a1a13d5de10df2126e3e64
-
SHA1
2055501abc523175622140477108ac8efa5f35b8
-
SHA256
4c3f07e19fa39ee97fe42dcc8d737054693af6610536d4267d21a17665c3df60
-
SHA512
b4fa820f4a64a9c593c7efa7bf611872be9920fb16e5f8136f52eba8a5ee62c7c286270105ff5c334427a4d7ce9e8c87961843ea89c6f32dddbe39f5d72fa57f
-
SSDEEP
24576:myMXjREyDlFR9pDR0c2b7jBj0HrLQ74eJf1KW+He3P:1MXdEyfbpVzU79j0HrLQ74e9v+He3
Static task
static1
Behavioral task
behavioral1
Sample
4c3f07e19fa39ee97fe42dcc8d737054693af6610536d4267d21a17665c3df60.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
lisa
83.97.73.122:19062
-
auth_value
c2dc311db9820012377b054447d37949
Extracted
redline
goga
83.97.73.122:19062
-
auth_value
6d57dff6d3c42dddb8a76dc276b8467f
Targets
-
-
Target
4c3f07e19fa39ee97fe42dcc8d737054693af6610536d4267d21a17665c3df60
-
Size
1.0MB
-
MD5
3cf31a2bb8a1a13d5de10df2126e3e64
-
SHA1
2055501abc523175622140477108ac8efa5f35b8
-
SHA256
4c3f07e19fa39ee97fe42dcc8d737054693af6610536d4267d21a17665c3df60
-
SHA512
b4fa820f4a64a9c593c7efa7bf611872be9920fb16e5f8136f52eba8a5ee62c7c286270105ff5c334427a4d7ce9e8c87961843ea89c6f32dddbe39f5d72fa57f
-
SSDEEP
24576:myMXjREyDlFR9pDR0c2b7jBj0HrLQ74eJf1KW+He3P:1MXdEyfbpVzU79j0HrLQ74e9v+He3
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-