General
-
Target
3b1eb6f51acb9cd4aadd98123d6533ad4e3802e453f8101afb9f3d09b5ae800e
-
Size
729KB
-
Sample
230605-rcndcshe7w
-
MD5
a03d2fc1ff21d97a4dcb3422d5a49a39
-
SHA1
2a68c582def65f6e93da8ea11b91c4a056712ce1
-
SHA256
3b1eb6f51acb9cd4aadd98123d6533ad4e3802e453f8101afb9f3d09b5ae800e
-
SHA512
808d9baecbc52928eafe6e33e811b51e163ea71520170f6c567fde35df0f8dd9d1b5d542ae6318201396060b1974f8e24b9d33e7970aa8bea5ad511d61604b04
-
SSDEEP
12288:bMrdy90FlI0Ket84Le0rWk/iVatCVE/DBxbtfNxjGNfweFU:iywKm84y+GsC6rvt3iwUU
Static task
static1
Malware Config
Extracted
redline
maxi
83.97.73.126:19048
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Extracted
redline
metro
83.97.73.126:19048
-
auth_value
f7fd4aa816bdbaad933b45b51d9b6b1a
Extracted
redline
diza
83.97.73.126:19048
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Targets
-
-
Target
3b1eb6f51acb9cd4aadd98123d6533ad4e3802e453f8101afb9f3d09b5ae800e
-
Size
729KB
-
MD5
a03d2fc1ff21d97a4dcb3422d5a49a39
-
SHA1
2a68c582def65f6e93da8ea11b91c4a056712ce1
-
SHA256
3b1eb6f51acb9cd4aadd98123d6533ad4e3802e453f8101afb9f3d09b5ae800e
-
SHA512
808d9baecbc52928eafe6e33e811b51e163ea71520170f6c567fde35df0f8dd9d1b5d542ae6318201396060b1974f8e24b9d33e7970aa8bea5ad511d61604b04
-
SSDEEP
12288:bMrdy90FlI0Ket84Le0rWk/iVatCVE/DBxbtfNxjGNfweFU:iywKm84y+GsC6rvt3iwUU
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-