General
-
Target
5a991c03f75a71834347ed5f8871c17bfe63c2cba9f8c4addce224efd063318b
-
Size
1.0MB
-
Sample
230526-zcgvksha95
-
MD5
4eb5e897742e57b46146f92dfcecd219
-
SHA1
3f9c5ebb3fba4bd6e5f050e9c839f7fb748c249d
-
SHA256
5a991c03f75a71834347ed5f8871c17bfe63c2cba9f8c4addce224efd063318b
-
SHA512
bc5b56ac36e1a5707af8df8dbc9147031277bde4cbcfad942ff238445be58d7dc739abdc7f589af7a5e8b108d341dc3d8e00d81dd116425e06537d886b44736e
-
SSDEEP
24576:oyXOVf98M4mnqWzjF7SbJViFVE2OorS5s1:vXyWenxJIJk42OIx
Static task
static1
Malware Config
Extracted
redline
lisa
83.97.73.122:19062
-
auth_value
c2dc311db9820012377b054447d37949
Extracted
redline
goga
83.97.73.122:19062
-
auth_value
6d57dff6d3c42dddb8a76dc276b8467f
Extracted
asyncrat
Venom Pwn3rzs' Edtition v6.0.1
Newday2
BYUzsfcfTrDGdfgfGfnhhy6cerhcehrctRCRTHCr
-
delay
1
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/7JZQMzKS
Targets
-
-
Target
5a991c03f75a71834347ed5f8871c17bfe63c2cba9f8c4addce224efd063318b
-
Size
1.0MB
-
MD5
4eb5e897742e57b46146f92dfcecd219
-
SHA1
3f9c5ebb3fba4bd6e5f050e9c839f7fb748c249d
-
SHA256
5a991c03f75a71834347ed5f8871c17bfe63c2cba9f8c4addce224efd063318b
-
SHA512
bc5b56ac36e1a5707af8df8dbc9147031277bde4cbcfad942ff238445be58d7dc739abdc7f589af7a5e8b108d341dc3d8e00d81dd116425e06537d886b44736e
-
SSDEEP
24576:oyXOVf98M4mnqWzjF7SbJViFVE2OorS5s1:vXyWenxJIJk42OIx
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Async RAT payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-