General
-
Target
f733dd64eafa3bde8bb31e1cea4f18683616a8d4d188b92c0d93169a3674d3a3
-
Size
1.0MB
-
Sample
230529-y5bctsdd83
-
MD5
239a5e0f34649d7752781efa1a0322b4
-
SHA1
1bf85e003d72f86a615946c12b6d1cbde8b77925
-
SHA256
f733dd64eafa3bde8bb31e1cea4f18683616a8d4d188b92c0d93169a3674d3a3
-
SHA512
7f71bc2feccc04d1e8635079867c0f76bb678214ee0d057dbf228054974e25ce2ae911e0116323838bde897fa907038ab15a340fd38de57d7d7c7cf42a3e74a2
-
SSDEEP
24576:zyTeQDal/GTjF3Wki4JN/UlJT6D6XnpmEqV4X:GyQq4xWmJNYJOD6Xpfq4
Static task
static1
Behavioral task
behavioral1
Sample
f733dd64eafa3bde8bb31e1cea4f18683616a8d4d188b92c0d93169a3674d3a3.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
lizsa
83.97.73.127:19045
-
auth_value
44b0b71b36e78465dbdebb4ecfb78b77
Extracted
redline
metro
83.97.73.127:19045
-
auth_value
f7fd4aa816bdbaad933b45b51d9b6b1a
Targets
-
-
Target
f733dd64eafa3bde8bb31e1cea4f18683616a8d4d188b92c0d93169a3674d3a3
-
Size
1.0MB
-
MD5
239a5e0f34649d7752781efa1a0322b4
-
SHA1
1bf85e003d72f86a615946c12b6d1cbde8b77925
-
SHA256
f733dd64eafa3bde8bb31e1cea4f18683616a8d4d188b92c0d93169a3674d3a3
-
SHA512
7f71bc2feccc04d1e8635079867c0f76bb678214ee0d057dbf228054974e25ce2ae911e0116323838bde897fa907038ab15a340fd38de57d7d7c7cf42a3e74a2
-
SSDEEP
24576:zyTeQDal/GTjF3Wki4JN/UlJT6D6XnpmEqV4X:GyQq4xWmJNYJOD6Xpfq4
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-