General
-
Target
920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587
-
Size
580KB
-
Sample
230605-metkyafh73
-
MD5
e68bf83d4ba9d30b8139951cf3bdb70f
-
SHA1
c7403616495758559d4674d0b1b58849f29ee0fd
-
SHA256
920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587
-
SHA512
db0a1666f0180a32d01b5204aecfa3aca2aecf59909683c569919d69c4c0de1ec16b72960d38dc607f37509dd503f296fa81f7c3951f69b9feb77f002c21ca63
-
SSDEEP
12288:jMrty90Rxy2d0MUSLqgoitl+ycBs0IpxdLymtrbylQ:6yGFz/nPtrpxVdxbyK
Static task
static1
Behavioral task
behavioral1
Sample
920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
maxi
83.97.73.126:19046
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Targets
-
-
Target
920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587
-
Size
580KB
-
MD5
e68bf83d4ba9d30b8139951cf3bdb70f
-
SHA1
c7403616495758559d4674d0b1b58849f29ee0fd
-
SHA256
920feb2ecf913eeeb9529bf00bf448957e6bf72d53cef8d52634e6b8e5485587
-
SHA512
db0a1666f0180a32d01b5204aecfa3aca2aecf59909683c569919d69c4c0de1ec16b72960d38dc607f37509dd503f296fa81f7c3951f69b9feb77f002c21ca63
-
SSDEEP
12288:jMrty90Rxy2d0MUSLqgoitl+ycBs0IpxdLymtrbylQ:6yGFz/nPtrpxVdxbyK
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-