General
-
Target
3543273aa6895c61bec2feb5b5575ed27f08e8f69030d91bcc4090efa4a3c951
-
Size
755KB
-
Sample
230601-w35sjsfg74
-
MD5
4f863bb7be1e245e853336dd236da97c
-
SHA1
40ccc9a1a8fc89d58b2a9008c93b08e9bb7a190a
-
SHA256
3543273aa6895c61bec2feb5b5575ed27f08e8f69030d91bcc4090efa4a3c951
-
SHA512
241608eddd283b1ec7e49548ccc133c40aac5c26a3c8b8046bba75c2e8610dff0cc50a0fea9bf98813b858d9101904de150a7e60f9e0665effe5413c9ce2f07b
-
SSDEEP
12288:MMr2y90HcT49DotBGnszA7wJ4UvOt1ANQXKevfG9tzhVz5sJHroemw:SyhT49Dg0wVOtuNCKh9JCo8
Static task
static1
Behavioral task
behavioral1
Sample
3543273aa6895c61bec2feb5b5575ed27f08e8f69030d91bcc4090efa4a3c951.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
redline
diza
83.97.73.127:19045
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Extracted
redline
rocker
83.97.73.127:19045
-
auth_value
b4693c25843b5a1c7d63376e73e32dae
Targets
-
-
Target
3543273aa6895c61bec2feb5b5575ed27f08e8f69030d91bcc4090efa4a3c951
-
Size
755KB
-
MD5
4f863bb7be1e245e853336dd236da97c
-
SHA1
40ccc9a1a8fc89d58b2a9008c93b08e9bb7a190a
-
SHA256
3543273aa6895c61bec2feb5b5575ed27f08e8f69030d91bcc4090efa4a3c951
-
SHA512
241608eddd283b1ec7e49548ccc133c40aac5c26a3c8b8046bba75c2e8610dff0cc50a0fea9bf98813b858d9101904de150a7e60f9e0665effe5413c9ce2f07b
-
SSDEEP
12288:MMr2y90HcT49DotBGnszA7wJ4UvOt1ANQXKevfG9tzhVz5sJHroemw:SyhT49Dg0wVOtuNCKh9JCo8
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-