General
-
Target
466840c87be990048d1b34494bad53f2a1bf33ccf607c4b97cfa4f818ff98efc
-
Size
1.0MB
-
Sample
230526-sycdnagb68
-
MD5
3229d83b8a18b54a4ffbf8acb9680b4b
-
SHA1
2384cf93ba41eecfb01b536e1241b20cbc6db843
-
SHA256
466840c87be990048d1b34494bad53f2a1bf33ccf607c4b97cfa4f818ff98efc
-
SHA512
88fd6f69f41a3d5b7a060a551c8237797f4ba90300d034b6e010e45406867ea6a8378c1e7f56fbaf16c0933977724e7279e0f24abd953ba49c225b4c3b7e272a
-
SSDEEP
24576:ayIxjw6TWVgNO9CX/6T34yWVp4bfa6GdRfU3KQiU2CI/G3c4dt:hojPTWVgNSIZ5vyf7Gd2ai9I/8c4
Static task
static1
Behavioral task
behavioral1
Sample
466840c87be990048d1b34494bad53f2a1bf33ccf607c4b97cfa4f818ff98efc.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
lisa
83.97.73.122:19062
-
auth_value
c2dc311db9820012377b054447d37949
Extracted
redline
goga
83.97.73.122:19062
-
auth_value
6d57dff6d3c42dddb8a76dc276b8467f
Targets
-
-
Target
466840c87be990048d1b34494bad53f2a1bf33ccf607c4b97cfa4f818ff98efc
-
Size
1.0MB
-
MD5
3229d83b8a18b54a4ffbf8acb9680b4b
-
SHA1
2384cf93ba41eecfb01b536e1241b20cbc6db843
-
SHA256
466840c87be990048d1b34494bad53f2a1bf33ccf607c4b97cfa4f818ff98efc
-
SHA512
88fd6f69f41a3d5b7a060a551c8237797f4ba90300d034b6e010e45406867ea6a8378c1e7f56fbaf16c0933977724e7279e0f24abd953ba49c225b4c3b7e272a
-
SSDEEP
24576:ayIxjw6TWVgNO9CX/6T34yWVp4bfa6GdRfU3KQiU2CI/G3c4dt:hojPTWVgNSIZ5vyf7Gd2ai9I/8c4
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-