General
-
Target
730deace6c358e0e0e43b75606e3d772210dca4e47acbfa1ceea8cb5b5de1946
-
Size
729KB
-
Sample
230605-pd1c7sha5v
-
MD5
86bb3505649066771ed53e7b2aeab144
-
SHA1
3a2f69d5bc9e51883d4c64ab8012fe59fa08d9ce
-
SHA256
730deace6c358e0e0e43b75606e3d772210dca4e47acbfa1ceea8cb5b5de1946
-
SHA512
447908dfbce1dbe0e597256bac9e48bcf329df4d6204c058fc23a699a01db35fe395668f1e70c66b031348b214de8abab061d04a9d9b1002f772a8ee4bfd115f
-
SSDEEP
12288:mMrey90gro3fSKjknwEV0N+CtAaciYHgd5MCSUSPM/Ifz0X2K4clT8uePMvcgn:0yt9KInw80N+OYg5MCS9rfzw2M8ueGc6
Static task
static1
Behavioral task
behavioral1
Sample
730deace6c358e0e0e43b75606e3d772210dca4e47acbfa1ceea8cb5b5de1946.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
maxi
83.97.73.126:19046
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Targets
-
-
Target
730deace6c358e0e0e43b75606e3d772210dca4e47acbfa1ceea8cb5b5de1946
-
Size
729KB
-
MD5
86bb3505649066771ed53e7b2aeab144
-
SHA1
3a2f69d5bc9e51883d4c64ab8012fe59fa08d9ce
-
SHA256
730deace6c358e0e0e43b75606e3d772210dca4e47acbfa1ceea8cb5b5de1946
-
SHA512
447908dfbce1dbe0e597256bac9e48bcf329df4d6204c058fc23a699a01db35fe395668f1e70c66b031348b214de8abab061d04a9d9b1002f772a8ee4bfd115f
-
SSDEEP
12288:mMrey90gro3fSKjknwEV0N+CtAaciYHgd5MCSUSPM/Ifz0X2K4clT8uePMvcgn:0yt9KInw80N+OYg5MCS9rfzw2M8ueGc6
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-