General
-
Target
1a89db3d647f3d8cc40c699720597e7a0ab28181508cc895e6890b4738512d27
-
Size
738KB
-
Sample
230606-tg24esee52
-
MD5
43cec344ceb337c221f534adcdaa2a65
-
SHA1
93e14be40a09c497e870d4b2bcb220faa608596b
-
SHA256
1a89db3d647f3d8cc40c699720597e7a0ab28181508cc895e6890b4738512d27
-
SHA512
6d84bf7e2e137337ee08f1ef6f54017e60949bcec3246669107b6f8d7e1da4dc4a1de58c97c42d719da18da2df6caca6b41a737c36a069fb14984b1d1f76d81d
-
SSDEEP
12288:SMrJy900wjsw+7c92icSzBaoykt5MNzNkDRyOy41yUxzqIVW90Od9tMSUbkLP+4t:XyHwjsFI4fKBaoya5SzNcAENqIV+9sbk
Static task
static1
Behavioral task
behavioral1
Sample
1a89db3d647f3d8cc40c699720597e7a0ab28181508cc895e6890b4738512d27.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
maxi
83.97.73.126:19048
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Targets
-
-
Target
1a89db3d647f3d8cc40c699720597e7a0ab28181508cc895e6890b4738512d27
-
Size
738KB
-
MD5
43cec344ceb337c221f534adcdaa2a65
-
SHA1
93e14be40a09c497e870d4b2bcb220faa608596b
-
SHA256
1a89db3d647f3d8cc40c699720597e7a0ab28181508cc895e6890b4738512d27
-
SHA512
6d84bf7e2e137337ee08f1ef6f54017e60949bcec3246669107b6f8d7e1da4dc4a1de58c97c42d719da18da2df6caca6b41a737c36a069fb14984b1d1f76d81d
-
SSDEEP
12288:SMrJy900wjsw+7c92icSzBaoykt5MNzNkDRyOy41yUxzqIVW90Od9tMSUbkLP+4t:XyHwjsFI4fKBaoya5SzNcAENqIV+9sbk
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-