General
-
Target
2442aada3609806df15c3712c3fe8f0fd07880bd2a69bfd675d265fd238c4749
-
Size
772KB
-
Sample
230608-kr7l8adh41
-
MD5
1926e9867d48aa25dc298e95de1d9f92
-
SHA1
b424c2790f9bf8e29c9b64db5d8904d9153a6c01
-
SHA256
2442aada3609806df15c3712c3fe8f0fd07880bd2a69bfd675d265fd238c4749
-
SHA512
ca278d5f10c7745bcefca30c8754de7c1836068b15ffbcfa9cc4c9d35abbec1e5c4e5c1297a3806ea9d4bece7f4450329f7f63efe97522e15fe589197329c948
-
SSDEEP
12288:hMrpy909GcSohc1YULfQk4MIDEcJNmtPBe9DeZD/pTlMiCUucum2ARimjTWZu:AyYSSczfPmESyBBZD/TC9cuaRrcu
Static task
static1
Behavioral task
behavioral1
Sample
2442aada3609806df15c3712c3fe8f0fd07880bd2a69bfd675d265fd238c4749.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
redline
maxi
83.97.73.129:19068
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Extracted
redline
sheron
83.97.73.129:19068
-
auth_value
2d067e7e2372227d3a03b335260112e9
Targets
-
-
Target
2442aada3609806df15c3712c3fe8f0fd07880bd2a69bfd675d265fd238c4749
-
Size
772KB
-
MD5
1926e9867d48aa25dc298e95de1d9f92
-
SHA1
b424c2790f9bf8e29c9b64db5d8904d9153a6c01
-
SHA256
2442aada3609806df15c3712c3fe8f0fd07880bd2a69bfd675d265fd238c4749
-
SHA512
ca278d5f10c7745bcefca30c8754de7c1836068b15ffbcfa9cc4c9d35abbec1e5c4e5c1297a3806ea9d4bece7f4450329f7f63efe97522e15fe589197329c948
-
SSDEEP
12288:hMrpy909GcSohc1YULfQk4MIDEcJNmtPBe9DeZD/pTlMiCUucum2ARimjTWZu:AyYSSczfPmESyBBZD/TC9cuaRrcu
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-