General
-
Target
bf042f800bbe6fe63c13c7d2114e8e7e545adf8e9fe075ab7541372726ddc6e3
-
Size
625KB
-
Sample
230604-smmp9ace57
-
MD5
4484ff4390239645f50da83755583b20
-
SHA1
8a3dd6d23446bc4bec1d5160479357c5a6202d1d
-
SHA256
bf042f800bbe6fe63c13c7d2114e8e7e545adf8e9fe075ab7541372726ddc6e3
-
SHA512
9b1a1b301866f2211e01843ddb278625d6c72ec6bd00d5233410f91331c39372e088c8e295ce8342a3cc3a61da40078f18a0eb7e65c2fbe7e60fe1821a755f40
-
SSDEEP
12288:ZMrty900cWwEp8Vg4Bo1TpZhHvbkWGwnum7MVXOoRTxLKsAr3Co6jPd:Iy3ckFzhexA1cPd
Static task
static1
Behavioral task
behavioral1
Sample
bf042f800bbe6fe63c13c7d2114e8e7e545adf8e9fe075ab7541372726ddc6e3.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
redline
dusa
83.97.73.126:19046
-
auth_value
ee896466545fedf9de5406175fb82de5
Extracted
redline
brain
83.97.73.126:19046
-
auth_value
5fb8269baadec0c49899b9a7a0c8851f
Targets
-
-
Target
bf042f800bbe6fe63c13c7d2114e8e7e545adf8e9fe075ab7541372726ddc6e3
-
Size
625KB
-
MD5
4484ff4390239645f50da83755583b20
-
SHA1
8a3dd6d23446bc4bec1d5160479357c5a6202d1d
-
SHA256
bf042f800bbe6fe63c13c7d2114e8e7e545adf8e9fe075ab7541372726ddc6e3
-
SHA512
9b1a1b301866f2211e01843ddb278625d6c72ec6bd00d5233410f91331c39372e088c8e295ce8342a3cc3a61da40078f18a0eb7e65c2fbe7e60fe1821a755f40
-
SSDEEP
12288:ZMrty900cWwEp8Vg4Bo1TpZhHvbkWGwnum7MVXOoRTxLKsAr3Co6jPd:Iy3ckFzhexA1cPd
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-