General
-
Target
720a053e367ddcf8c05d85371a3ab6a3bf4f353eb8955333437562b5d714d94c
-
Size
735KB
-
Sample
230605-2xjwsaba99
-
MD5
ac51f94236a6d3666f53401f97a4987b
-
SHA1
a8cee2303e4942d0fb489ea774bb23ac3549e044
-
SHA256
720a053e367ddcf8c05d85371a3ab6a3bf4f353eb8955333437562b5d714d94c
-
SHA512
463124197c74576be38f302faa0d355195c783b20073819db52bdd35d2937c58bc352a5c7fb3ada4e3a77d5843da391039a60cf26d0dbc4498882324042d40af
-
SSDEEP
12288:qMrmy90iUcBaedTGAkwW+0wgI+gc1xmROV6C/DqtGJY5a:oy/xBnGAM+R9sa5yDUGJd
Static task
static1
Behavioral task
behavioral1
Sample
720a053e367ddcf8c05d85371a3ab6a3bf4f353eb8955333437562b5d714d94c.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
maxi
83.97.73.126:19048
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Targets
-
-
Target
720a053e367ddcf8c05d85371a3ab6a3bf4f353eb8955333437562b5d714d94c
-
Size
735KB
-
MD5
ac51f94236a6d3666f53401f97a4987b
-
SHA1
a8cee2303e4942d0fb489ea774bb23ac3549e044
-
SHA256
720a053e367ddcf8c05d85371a3ab6a3bf4f353eb8955333437562b5d714d94c
-
SHA512
463124197c74576be38f302faa0d355195c783b20073819db52bdd35d2937c58bc352a5c7fb3ada4e3a77d5843da391039a60cf26d0dbc4498882324042d40af
-
SSDEEP
12288:qMrmy90iUcBaedTGAkwW+0wgI+gc1xmROV6C/DqtGJY5a:oy/xBnGAM+R9sa5yDUGJd
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-