General
-
Target
4eacb38731971cff8cf5a14906c91d0deb6a1f6032ed8ba12379348f9a9e27ea
-
Size
738KB
-
Sample
230606-q4bcfadh83
-
MD5
10e18a2707e9318a0a7a16c01db038f2
-
SHA1
27a9d8341fde920ded27a3938d4a9b39ad58466e
-
SHA256
4eacb38731971cff8cf5a14906c91d0deb6a1f6032ed8ba12379348f9a9e27ea
-
SHA512
a3bcca06515d29cdbd2ea51650fd33650e786e37dbe2fa5efdd7cda8eb843e06a2738174252ae5ebc1f3d5865e3b454430e5da5c4a09d50a15a32ac84a3f2d0d
-
SSDEEP
12288:0Mr8y90crGBjpLTERugc/m1iRa/1NoXZky8p8jg/AeGK+rrw4wP:wyXrGBNYR/y6w4Nryc0eyf/4
Static task
static1
Behavioral task
behavioral1
Sample
4eacb38731971cff8cf5a14906c91d0deb6a1f6032ed8ba12379348f9a9e27ea.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
redline
maxi
83.97.73.126:19048
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Targets
-
-
Target
4eacb38731971cff8cf5a14906c91d0deb6a1f6032ed8ba12379348f9a9e27ea
-
Size
738KB
-
MD5
10e18a2707e9318a0a7a16c01db038f2
-
SHA1
27a9d8341fde920ded27a3938d4a9b39ad58466e
-
SHA256
4eacb38731971cff8cf5a14906c91d0deb6a1f6032ed8ba12379348f9a9e27ea
-
SHA512
a3bcca06515d29cdbd2ea51650fd33650e786e37dbe2fa5efdd7cda8eb843e06a2738174252ae5ebc1f3d5865e3b454430e5da5c4a09d50a15a32ac84a3f2d0d
-
SSDEEP
12288:0Mr8y90crGBjpLTERugc/m1iRa/1NoXZky8p8jg/AeGK+rrw4wP:wyXrGBNYR/y6w4Nryc0eyf/4
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-