General
-
Target
9df827fa644c50ca09524038b3c587641e1e5812e538d10e1b19e76340f241aa
-
Size
770KB
-
Sample
230608-r47ajsgb62
-
MD5
4b89f65e35b8787214fe0f6777baf9b1
-
SHA1
9be63bb18911874d4e2ceea874c2fb171fb40486
-
SHA256
9df827fa644c50ca09524038b3c587641e1e5812e538d10e1b19e76340f241aa
-
SHA512
0c15cf0dc230d3423c03d072a38addea1a7fa270499a583f1e37291c5205fe6d60c7e7dc5dc0c1d8e8e5579ceeeb278281d4c349c12a421b0089f14779a79999
-
SSDEEP
12288:iMr0y90rj2nQTUHzXEawvXgjqL3oJOxYyngopkjxSFCRIOxWCSHZgT3h:ayRHTpEwjWNgLx2CRzxWCS583h
Static task
static1
Behavioral task
behavioral1
Sample
9df827fa644c50ca09524038b3c587641e1e5812e538d10e1b19e76340f241aa.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
redline
diza
83.97.73.129:19068
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Extracted
redline
sheron
83.97.73.129:19068
-
auth_value
2d067e7e2372227d3a03b335260112e9
Targets
-
-
Target
9df827fa644c50ca09524038b3c587641e1e5812e538d10e1b19e76340f241aa
-
Size
770KB
-
MD5
4b89f65e35b8787214fe0f6777baf9b1
-
SHA1
9be63bb18911874d4e2ceea874c2fb171fb40486
-
SHA256
9df827fa644c50ca09524038b3c587641e1e5812e538d10e1b19e76340f241aa
-
SHA512
0c15cf0dc230d3423c03d072a38addea1a7fa270499a583f1e37291c5205fe6d60c7e7dc5dc0c1d8e8e5579ceeeb278281d4c349c12a421b0089f14779a79999
-
SSDEEP
12288:iMr0y90rj2nQTUHzXEawvXgjqL3oJOxYyngopkjxSFCRIOxWCSHZgT3h:ayRHTpEwjWNgLx2CRzxWCS583h
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-