General
-
Target
2b4c0e5846698d9123d9e2372255f7ad26b4f7dcad10af96c8eceb2e20a3a1c1
-
Size
739KB
-
Sample
230606-qsqb8adh36
-
MD5
0a534cb2cd92e1aec6a499ce81a96f69
-
SHA1
141b40bfb143e50635cbf27fb00c1497342ff864
-
SHA256
2b4c0e5846698d9123d9e2372255f7ad26b4f7dcad10af96c8eceb2e20a3a1c1
-
SHA512
d8b9a6fcd2d590517250b720d1905f482a4ed8534f39c2d07c540c9d9c3c1bba333ce7b710004aa404a06b2517f0fb8d335a35295fe91e90283ff4ef04a985cc
-
SSDEEP
12288:yMrqy9075/bfpVL+6R4sgSMCWHHjfNrzNWB000eVgwdzMQk2wIwswLa:0ykVxFhMCiHjf5z8+01OeMdmwO
Static task
static1
Behavioral task
behavioral1
Sample
2b4c0e5846698d9123d9e2372255f7ad26b4f7dcad10af96c8eceb2e20a3a1c1.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
maxi
83.97.73.126:19048
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Targets
-
-
Target
2b4c0e5846698d9123d9e2372255f7ad26b4f7dcad10af96c8eceb2e20a3a1c1
-
Size
739KB
-
MD5
0a534cb2cd92e1aec6a499ce81a96f69
-
SHA1
141b40bfb143e50635cbf27fb00c1497342ff864
-
SHA256
2b4c0e5846698d9123d9e2372255f7ad26b4f7dcad10af96c8eceb2e20a3a1c1
-
SHA512
d8b9a6fcd2d590517250b720d1905f482a4ed8534f39c2d07c540c9d9c3c1bba333ce7b710004aa404a06b2517f0fb8d335a35295fe91e90283ff4ef04a985cc
-
SSDEEP
12288:yMrqy9075/bfpVL+6R4sgSMCWHHjfNrzNWB000eVgwdzMQk2wIwswLa:0ykVxFhMCiHjf5z8+01OeMdmwO
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-