General
-
Target
f634c06dc463ffdd17a9a5eb49b702569cb816f6b0434e0e9592ca73d5198494
-
Size
766KB
-
Sample
230608-rvcpksgg6v
-
MD5
a2d1c22481ae6aacf1b7ac9039bb7c7d
-
SHA1
9b6629dd3ea8909bcd8cb848b7e41b6e393af460
-
SHA256
f634c06dc463ffdd17a9a5eb49b702569cb816f6b0434e0e9592ca73d5198494
-
SHA512
2d3be7cf53d60a7b98aa3b7dcd3fccefa1f6d36bdef736dcd86941a84f40b057fe1c0787bcf2e4596ce92471f309ac9ff49a0f0484417fcfdff9fd3fb0b99d71
-
SSDEEP
12288:FMrYy90dPwjijlj5p1NjPj8t5p68ozVLkmJUMKk3FBpTTtbN9VYgdb:9yKojC95RjG2ppLzKI19Gy
Static task
static1
Behavioral task
behavioral1
Sample
f634c06dc463ffdd17a9a5eb49b702569cb816f6b0434e0e9592ca73d5198494.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
diza
83.97.73.129:19068
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Extracted
redline
sheron
83.97.73.129:19068
-
auth_value
2d067e7e2372227d3a03b335260112e9
Targets
-
-
Target
f634c06dc463ffdd17a9a5eb49b702569cb816f6b0434e0e9592ca73d5198494
-
Size
766KB
-
MD5
a2d1c22481ae6aacf1b7ac9039bb7c7d
-
SHA1
9b6629dd3ea8909bcd8cb848b7e41b6e393af460
-
SHA256
f634c06dc463ffdd17a9a5eb49b702569cb816f6b0434e0e9592ca73d5198494
-
SHA512
2d3be7cf53d60a7b98aa3b7dcd3fccefa1f6d36bdef736dcd86941a84f40b057fe1c0787bcf2e4596ce92471f309ac9ff49a0f0484417fcfdff9fd3fb0b99d71
-
SSDEEP
12288:FMrYy90dPwjijlj5p1NjPj8t5p68ozVLkmJUMKk3FBpTTtbN9VYgdb:9yKojC95RjG2ppLzKI19Gy
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-