General
-
Target
02069499.exe
-
Size
1.0MB
-
Sample
230529-j811bsbb6y
-
MD5
c6b91ff8745691e8f382f4d44fa64bf4
-
SHA1
719cb70116b636f18e54bfb7b293ba9525f5717d
-
SHA256
3b28a1a02b86837e7e951ee2862634f921e9be6089ce542eaf4b2a1652c8e7bd
-
SHA512
a07a12a9da50c06838a28977d84d17f713ef551d355924123a8f537ea596aa6b6eb659f4369451bb465dc476bdd108cd2d4bebc402db5b6270f856ec3f0a39ef
-
SSDEEP
24576:Cy6BM/x6OAdGmCmfYWI9OQyMIwMAv/7imPh1Pbn4vRtP:p6BMsOmOWI9lyavHHX4z
Static task
static1
Behavioral task
behavioral1
Sample
02069499.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
02069499.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
lizsa
83.97.73.127:19045
-
auth_value
44b0b71b36e78465dbdebb4ecfb78b77
Extracted
redline
metro
83.97.73.127:19045
-
auth_value
f7fd4aa816bdbaad933b45b51d9b6b1a
Extracted
redline
Redline
85.31.54.183:18435
-
auth_value
50837656cba6e4dd56bfbb4a61dadb63
Targets
-
-
Target
02069499.exe
-
Size
1.0MB
-
MD5
c6b91ff8745691e8f382f4d44fa64bf4
-
SHA1
719cb70116b636f18e54bfb7b293ba9525f5717d
-
SHA256
3b28a1a02b86837e7e951ee2862634f921e9be6089ce542eaf4b2a1652c8e7bd
-
SHA512
a07a12a9da50c06838a28977d84d17f713ef551d355924123a8f537ea596aa6b6eb659f4369451bb465dc476bdd108cd2d4bebc402db5b6270f856ec3f0a39ef
-
SSDEEP
24576:Cy6BM/x6OAdGmCmfYWI9OQyMIwMAv/7imPh1Pbn4vRtP:p6BMsOmOWI9lyavHHX4z
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-