General
-
Target
5ed45e6fe41fb7b7f093c150a506f5c234dc164ed0b4ed7d1b970dc6a1676fd7
-
Size
739KB
-
Sample
230606-qerccsec7w
-
MD5
e7ff2a2862cde8845e711eb5a132c41f
-
SHA1
966f8457dc3a809606bcb4dac709cafc64cd6c02
-
SHA256
5ed45e6fe41fb7b7f093c150a506f5c234dc164ed0b4ed7d1b970dc6a1676fd7
-
SHA512
4fb5e0e90858532903cfbe90e3f449ce7a69e9921bed5d43e9973612bb50abf1e1a158773eddbfbee959e8e62754f759f48ad674b80b48ae369d31f8b989f660
-
SSDEEP
12288:8MrYy90o0Y7Py/kaUvYYlkuMgHmkiUHPL4ZKpOxJrow97Ie8YECJ+vtz:Uyfl7Pwka2zlkuMgGkiqPLmK8xT90+Eh
Static task
static1
Behavioral task
behavioral1
Sample
5ed45e6fe41fb7b7f093c150a506f5c234dc164ed0b4ed7d1b970dc6a1676fd7.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
maxi
83.97.73.126:19048
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Targets
-
-
Target
5ed45e6fe41fb7b7f093c150a506f5c234dc164ed0b4ed7d1b970dc6a1676fd7
-
Size
739KB
-
MD5
e7ff2a2862cde8845e711eb5a132c41f
-
SHA1
966f8457dc3a809606bcb4dac709cafc64cd6c02
-
SHA256
5ed45e6fe41fb7b7f093c150a506f5c234dc164ed0b4ed7d1b970dc6a1676fd7
-
SHA512
4fb5e0e90858532903cfbe90e3f449ce7a69e9921bed5d43e9973612bb50abf1e1a158773eddbfbee959e8e62754f759f48ad674b80b48ae369d31f8b989f660
-
SSDEEP
12288:8MrYy90o0Y7Py/kaUvYYlkuMgHmkiUHPL4ZKpOxJrow97Ie8YECJ+vtz:Uyfl7Pwka2zlkuMgGkiqPLmK8xT90+Eh
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-