General
-
Target
b0e2b0ea17c15735322434a431534acb899b9b076c4579c5be3dbdf5c69ac579
-
Size
580KB
-
Sample
230605-bty87aed87
-
MD5
4795feacbabbe87c214e2f02335cbb03
-
SHA1
4be6946e768a038d68338c7e18424f8ee5e1ad2b
-
SHA256
b0e2b0ea17c15735322434a431534acb899b9b076c4579c5be3dbdf5c69ac579
-
SHA512
104963df00dc6e7b556e5c99b8ab4bfcf07790a80e48552860be3825037f448e6b3095ad9ff22e010d13f46b6ad5d0263a8bad5e87bb8e2c2fdf4b66e22db282
-
SSDEEP
12288:ZMrdy90Ok97Uc9SL3wdD3nmeXZo7mX17zwMOa6by:AyO97U3LgD3nmCoa17LOnby
Static task
static1
Behavioral task
behavioral1
Sample
b0e2b0ea17c15735322434a431534acb899b9b076c4579c5be3dbdf5c69ac579.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
maxi
83.97.73.126:19046
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Targets
-
-
Target
b0e2b0ea17c15735322434a431534acb899b9b076c4579c5be3dbdf5c69ac579
-
Size
580KB
-
MD5
4795feacbabbe87c214e2f02335cbb03
-
SHA1
4be6946e768a038d68338c7e18424f8ee5e1ad2b
-
SHA256
b0e2b0ea17c15735322434a431534acb899b9b076c4579c5be3dbdf5c69ac579
-
SHA512
104963df00dc6e7b556e5c99b8ab4bfcf07790a80e48552860be3825037f448e6b3095ad9ff22e010d13f46b6ad5d0263a8bad5e87bb8e2c2fdf4b66e22db282
-
SSDEEP
12288:ZMrdy90Ok97Uc9SL3wdD3nmeXZo7mX17zwMOa6by:AyO97U3LgD3nmCoa17LOnby
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-