General
-
Target
2542575c96389e587488552e829b3be87ab507c8eb97cc83b4fc7d1e7c73ab9a
-
Size
727KB
-
Sample
230605-smdgkshh5s
-
MD5
cc5e53ac466ebf0bcf42563f87c3d6b3
-
SHA1
e8872c01c5d774f0773c2814804fe1f493ce5e56
-
SHA256
2542575c96389e587488552e829b3be87ab507c8eb97cc83b4fc7d1e7c73ab9a
-
SHA512
6e7550182e3f23b4e17a1ddfff6d136b7bbe84f166f3c2d4c808d0c018718b3e0c53fb716ba6ed206d3c02a21ce1b5c5da047616600bbfcc878e27cc2a0248f2
-
SSDEEP
12288:DMrCy90JSLK1hinUGqPmpKAZ8de71rBDdkaH/B8Z6pyIiH6jFU:hyryhinPqwrZGezJkafB8ZeybH6jy
Static task
static1
Behavioral task
behavioral1
Sample
2542575c96389e587488552e829b3be87ab507c8eb97cc83b4fc7d1e7c73ab9a.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
maxi
83.97.73.126:19048
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Extracted
redline
metro
83.97.73.126:19048
-
auth_value
f7fd4aa816bdbaad933b45b51d9b6b1a
Extracted
redline
diza
83.97.73.126:19048
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Targets
-
-
Target
2542575c96389e587488552e829b3be87ab507c8eb97cc83b4fc7d1e7c73ab9a
-
Size
727KB
-
MD5
cc5e53ac466ebf0bcf42563f87c3d6b3
-
SHA1
e8872c01c5d774f0773c2814804fe1f493ce5e56
-
SHA256
2542575c96389e587488552e829b3be87ab507c8eb97cc83b4fc7d1e7c73ab9a
-
SHA512
6e7550182e3f23b4e17a1ddfff6d136b7bbe84f166f3c2d4c808d0c018718b3e0c53fb716ba6ed206d3c02a21ce1b5c5da047616600bbfcc878e27cc2a0248f2
-
SSDEEP
12288:DMrCy90JSLK1hinUGqPmpKAZ8de71rBDdkaH/B8Z6pyIiH6jFU:hyryhinPqwrZGezJkafB8ZeybH6jy
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-