General
-
Target
434d7530ab676b9c5085a1e14351d73aae7d4f5da1cf64cc662352b83ddac18b
-
Size
1.1MB
-
Sample
230529-bgezsahe4w
-
MD5
6fb75fe391e006f7cf47306a2167a761
-
SHA1
073117199995ad069e3f8ab0b16b7306f9407eb5
-
SHA256
434d7530ab676b9c5085a1e14351d73aae7d4f5da1cf64cc662352b83ddac18b
-
SHA512
bbf31f77c6ff12170c879e5e146a3c8922537e75c03c1f120a6fac88a46f199af3f613cb3db2dcec32a192b78739b55aa2fe3319a28860950d2403153dd12c4d
-
SSDEEP
24576:pyRRhPAWFSXwBhB6YtNefnQTUSFtpFyTT1p5C7mmSTs68iixf9At:cbxkk9OfnQv0tpE7mtw6sf9A
Static task
static1
Malware Config
Extracted
redline
lizsa
83.97.73.127:19045
-
auth_value
44b0b71b36e78465dbdebb4ecfb78b77
Extracted
redline
metro
83.97.73.127:19045
-
auth_value
f7fd4aa816bdbaad933b45b51d9b6b1a
Extracted
redline
Redline
85.31.54.183:18435
-
auth_value
50837656cba6e4dd56bfbb4a61dadb63
Targets
-
-
Target
434d7530ab676b9c5085a1e14351d73aae7d4f5da1cf64cc662352b83ddac18b
-
Size
1.1MB
-
MD5
6fb75fe391e006f7cf47306a2167a761
-
SHA1
073117199995ad069e3f8ab0b16b7306f9407eb5
-
SHA256
434d7530ab676b9c5085a1e14351d73aae7d4f5da1cf64cc662352b83ddac18b
-
SHA512
bbf31f77c6ff12170c879e5e146a3c8922537e75c03c1f120a6fac88a46f199af3f613cb3db2dcec32a192b78739b55aa2fe3319a28860950d2403153dd12c4d
-
SSDEEP
24576:pyRRhPAWFSXwBhB6YtNefnQTUSFtpFyTT1p5C7mmSTs68iixf9At:cbxkk9OfnQv0tpE7mtw6sf9A
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-