General
-
Target
i1644011.exe
-
Size
304KB
-
Sample
230604-fw1bgsbc32
-
MD5
2f6ea5b99ca33f4951938f8fe3ac478d
-
SHA1
8068319d2cb1d79196b73e65f1841202d0d99100
-
SHA256
88dbdd424e655c1a6f39fbd916138b953987ccabcb22babf0382e5eab7782839
-
SHA512
3fc91a75978b3cfe2a9473703aa9a1a375890a9f6307953b708013af53045e652684fa35475bfdff2c0745043194635606b2e4e2c84421d12ee93a5eefe14452
-
SSDEEP
6144:7rRCtFmE8QxL0SYZ3gOkB4XreVyDuAPN9/Qewn3tPlEKsgGE:pCtF0rekDuA1JuHIgp
Static task
static1
Behavioral task
behavioral1
Sample
i1644011.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
i1644011.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
brain
83.97.73.126:19046
-
auth_value
5fb8269baadec0c49899b9a7a0c8851f
Targets
-
-
Target
i1644011.exe
-
Size
304KB
-
MD5
2f6ea5b99ca33f4951938f8fe3ac478d
-
SHA1
8068319d2cb1d79196b73e65f1841202d0d99100
-
SHA256
88dbdd424e655c1a6f39fbd916138b953987ccabcb22babf0382e5eab7782839
-
SHA512
3fc91a75978b3cfe2a9473703aa9a1a375890a9f6307953b708013af53045e652684fa35475bfdff2c0745043194635606b2e4e2c84421d12ee93a5eefe14452
-
SSDEEP
6144:7rRCtFmE8QxL0SYZ3gOkB4XreVyDuAPN9/Qewn3tPlEKsgGE:pCtF0rekDuA1JuHIgp
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-