General
-
Target
09863199.exe
-
Size
728KB
-
Sample
230605-r9mhbshc27
-
MD5
dc3ba672452bce8f550bf041fb467da5
-
SHA1
3c89946ebaca141652b02815bf5db522ea9f4a30
-
SHA256
7bf5499a369105ff1a98aff5807aed95f762ad9703b44e4f452dcb5b0283169a
-
SHA512
733845a3c0460666763f267b0e8f14114de094e76852a82126cbe0d539270b62fd28f1ae74a462347dc0360da4193360d05f64c5ff0c5b9e1d56b6d22210972f
-
SSDEEP
12288:zMr0y90F6y6Y+8hVmibAICTbu/FzMUoHr6UKEmfRL1F/US6yQIwS:Dy5pgxdzMUM6jJRLyyVP
Static task
static1
Behavioral task
behavioral1
Sample
09863199.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
09863199.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
maxi
83.97.73.126:19048
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Extracted
redline
metro
83.97.73.126:19048
-
auth_value
f7fd4aa816bdbaad933b45b51d9b6b1a
Targets
-
-
Target
09863199.exe
-
Size
728KB
-
MD5
dc3ba672452bce8f550bf041fb467da5
-
SHA1
3c89946ebaca141652b02815bf5db522ea9f4a30
-
SHA256
7bf5499a369105ff1a98aff5807aed95f762ad9703b44e4f452dcb5b0283169a
-
SHA512
733845a3c0460666763f267b0e8f14114de094e76852a82126cbe0d539270b62fd28f1ae74a462347dc0360da4193360d05f64c5ff0c5b9e1d56b6d22210972f
-
SSDEEP
12288:zMr0y90F6y6Y+8hVmibAICTbu/FzMUoHr6UKEmfRL1F/US6yQIwS:Dy5pgxdzMUM6jJRLyyVP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-