General
-
Target
03133999.exe
-
Size
729KB
-
Sample
230605-r4ce6shg2v
-
MD5
a03d2fc1ff21d97a4dcb3422d5a49a39
-
SHA1
2a68c582def65f6e93da8ea11b91c4a056712ce1
-
SHA256
3b1eb6f51acb9cd4aadd98123d6533ad4e3802e453f8101afb9f3d09b5ae800e
-
SHA512
808d9baecbc52928eafe6e33e811b51e163ea71520170f6c567fde35df0f8dd9d1b5d542ae6318201396060b1974f8e24b9d33e7970aa8bea5ad511d61604b04
-
SSDEEP
12288:bMrdy90FlI0Ket84Le0rWk/iVatCVE/DBxbtfNxjGNfweFU:iywKm84y+GsC6rvt3iwUU
Static task
static1
Behavioral task
behavioral1
Sample
03133999.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
03133999.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
redline
maxi
83.97.73.126:19048
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Extracted
redline
metro
83.97.73.126:19048
-
auth_value
f7fd4aa816bdbaad933b45b51d9b6b1a
Targets
-
-
Target
03133999.exe
-
Size
729KB
-
MD5
a03d2fc1ff21d97a4dcb3422d5a49a39
-
SHA1
2a68c582def65f6e93da8ea11b91c4a056712ce1
-
SHA256
3b1eb6f51acb9cd4aadd98123d6533ad4e3802e453f8101afb9f3d09b5ae800e
-
SHA512
808d9baecbc52928eafe6e33e811b51e163ea71520170f6c567fde35df0f8dd9d1b5d542ae6318201396060b1974f8e24b9d33e7970aa8bea5ad511d61604b04
-
SSDEEP
12288:bMrdy90FlI0Ket84Le0rWk/iVatCVE/DBxbtfNxjGNfweFU:iywKm84y+GsC6rvt3iwUU
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-