General
-
Target
df202d8bfd8d4fc017b3dd43ae93c32d.exe
-
Size
735KB
-
Sample
230606-lp32pade9s
-
MD5
df202d8bfd8d4fc017b3dd43ae93c32d
-
SHA1
8ca333235a256a5263f2364e26ef8a9db7e2b758
-
SHA256
434015a42546ee6b0e5f117631d9b594cd922889dd7223dab5fdce04f5efbb93
-
SHA512
527361523be2159c400cb9de0c3ebb29089bc791a89d09d71dfd4f02b48e0858b8028e6d2276b6a93ecba489cde7181d5f28492bab68f861751a978f213d86b8
-
SSDEEP
12288:5MrAy90H24AtlaAOO7t5WzhaaFSMjvfu936KZqTe86JKeW7BvA3:Zyi24At0e/WzJSH3LwTiWK
Static task
static1
Behavioral task
behavioral1
Sample
df202d8bfd8d4fc017b3dd43ae93c32d.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
df202d8bfd8d4fc017b3dd43ae93c32d.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
maxi
83.97.73.126:19048
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Targets
-
-
Target
df202d8bfd8d4fc017b3dd43ae93c32d.exe
-
Size
735KB
-
MD5
df202d8bfd8d4fc017b3dd43ae93c32d
-
SHA1
8ca333235a256a5263f2364e26ef8a9db7e2b758
-
SHA256
434015a42546ee6b0e5f117631d9b594cd922889dd7223dab5fdce04f5efbb93
-
SHA512
527361523be2159c400cb9de0c3ebb29089bc791a89d09d71dfd4f02b48e0858b8028e6d2276b6a93ecba489cde7181d5f28492bab68f861751a978f213d86b8
-
SSDEEP
12288:5MrAy90H24AtlaAOO7t5WzhaaFSMjvfu936KZqTe86JKeW7BvA3:Zyi24At0e/WzJSH3LwTiWK
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-