General
-
Target
42c0989c707d4a60c261bb38306bda3ef7037cac4f7a443047fd64765865be0b
-
Size
794KB
-
Sample
230603-jdq7msgc8x
-
MD5
e95eb749da79cd472380c9da1641b613
-
SHA1
96a0a24cc9b1db20050a7cbfd5e2905ba37e60b3
-
SHA256
42c0989c707d4a60c261bb38306bda3ef7037cac4f7a443047fd64765865be0b
-
SHA512
e7fd5f6a7e99e1fe564b9a4a069def37920c06842fdafbc7f2af621951d07a9eda3c47943779208f37ef72451d9196a36c11979ea6478b42ba68ef5193a54f81
-
SSDEEP
12288:oMrwy90wOGru5IZbJ5axQSuwlIQeVuDLZL1s1PaL9yX42DrOraowEfs7+OD3KtW1:4yM35cmO5XGLZL1s1G366LfAKtWHT5
Static task
static1
Behavioral task
behavioral1
Sample
42c0989c707d4a60c261bb38306bda3ef7037cac4f7a443047fd64765865be0b.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
maxi
83.97.73.126:19046
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Extracted
redline
metro
83.97.73.126:19046
-
auth_value
f7fd4aa816bdbaad933b45b51d9b6b1a
Targets
-
-
Target
42c0989c707d4a60c261bb38306bda3ef7037cac4f7a443047fd64765865be0b
-
Size
794KB
-
MD5
e95eb749da79cd472380c9da1641b613
-
SHA1
96a0a24cc9b1db20050a7cbfd5e2905ba37e60b3
-
SHA256
42c0989c707d4a60c261bb38306bda3ef7037cac4f7a443047fd64765865be0b
-
SHA512
e7fd5f6a7e99e1fe564b9a4a069def37920c06842fdafbc7f2af621951d07a9eda3c47943779208f37ef72451d9196a36c11979ea6478b42ba68ef5193a54f81
-
SSDEEP
12288:oMrwy90wOGru5IZbJ5axQSuwlIQeVuDLZL1s1PaL9yX42DrOraowEfs7+OD3KtW1:4yM35cmO5XGLZL1s1G366LfAKtWHT5
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-