General
-
Target
841696d9d6a4e6bded42e049376b7889e37e788b82ef903b8bd191234030b4dd
-
Size
735KB
-
Sample
230605-3l31ysbg3t
-
MD5
1388ed36b36f43e531e1db03a8f20ddd
-
SHA1
82bebac5208401ebdcc432d2546bee1c01a5611d
-
SHA256
841696d9d6a4e6bded42e049376b7889e37e788b82ef903b8bd191234030b4dd
-
SHA512
a22f389049513fc1d6ebaef33ff8830387ea857e001085fa273d3f299a3f4e9032929a21d0bb63c2dc73f161ed8d9bb97e5f0ecab085ed96731e153ceba25c1b
-
SSDEEP
12288:kMrmy90ziAej6nmllG+AaTG3TZ25L4d964Vab1xOusYYWKSYAA9frEo2k5rBSgOt:KyW4OnaRTG3TZ2ZyZab1xOXYYk3afr7I
Static task
static1
Behavioral task
behavioral1
Sample
841696d9d6a4e6bded42e049376b7889e37e788b82ef903b8bd191234030b4dd.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
maxi
83.97.73.126:19048
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Targets
-
-
Target
841696d9d6a4e6bded42e049376b7889e37e788b82ef903b8bd191234030b4dd
-
Size
735KB
-
MD5
1388ed36b36f43e531e1db03a8f20ddd
-
SHA1
82bebac5208401ebdcc432d2546bee1c01a5611d
-
SHA256
841696d9d6a4e6bded42e049376b7889e37e788b82ef903b8bd191234030b4dd
-
SHA512
a22f389049513fc1d6ebaef33ff8830387ea857e001085fa273d3f299a3f4e9032929a21d0bb63c2dc73f161ed8d9bb97e5f0ecab085ed96731e153ceba25c1b
-
SSDEEP
12288:kMrmy90ziAej6nmllG+AaTG3TZ25L4d964Vab1xOusYYWKSYAA9frEo2k5rBSgOt:KyW4OnaRTG3TZ2ZyZab1xOXYYk3afr7I
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-