General
-
Target
84d1157cde0f9b2f3dcaa221d327f34daedc3ebcd8742873f5425fbcd1029ea7
-
Size
728KB
-
Sample
230605-mhwjpsgd8w
-
MD5
7641aed2c29277824a16490189990c5b
-
SHA1
3377d67ceeab34e35f3a4229b157cbb8272f2617
-
SHA256
84d1157cde0f9b2f3dcaa221d327f34daedc3ebcd8742873f5425fbcd1029ea7
-
SHA512
b02e3c599321fbae0bd9027faa42a89c4051bf2cfa3ff43a8ef06a8a3b911f268396a97a6a314bb274175bd18a80ab8bb474c675e7dba36271b46c6a63627e5f
-
SSDEEP
12288:xMr2y90sehCY1aUQPaqg4XTtefuJuhbidOD8y5XqAIgodi92BmC:Ty2hCYIyOXReGJuhbYfmodi92gC
Static task
static1
Behavioral task
behavioral1
Sample
84d1157cde0f9b2f3dcaa221d327f34daedc3ebcd8742873f5425fbcd1029ea7.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
maxi
83.97.73.126:19046
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Targets
-
-
Target
84d1157cde0f9b2f3dcaa221d327f34daedc3ebcd8742873f5425fbcd1029ea7
-
Size
728KB
-
MD5
7641aed2c29277824a16490189990c5b
-
SHA1
3377d67ceeab34e35f3a4229b157cbb8272f2617
-
SHA256
84d1157cde0f9b2f3dcaa221d327f34daedc3ebcd8742873f5425fbcd1029ea7
-
SHA512
b02e3c599321fbae0bd9027faa42a89c4051bf2cfa3ff43a8ef06a8a3b911f268396a97a6a314bb274175bd18a80ab8bb474c675e7dba36271b46c6a63627e5f
-
SSDEEP
12288:xMr2y90sehCY1aUQPaqg4XTtefuJuhbidOD8y5XqAIgodi92BmC:Ty2hCYIyOXReGJuhbYfmodi92gC
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-