General
-
Target
b23d9feeb8ab194469a53b4a7f322f5728744459ad4a8b733cb97044bd8b920c
-
Size
771KB
-
Sample
230608-rxpf6agg8v
-
MD5
8f862685408fb0aa0630d6d720c454c0
-
SHA1
de56b0723eb0903d9c1f5a7bbe2e88d2c0790f18
-
SHA256
b23d9feeb8ab194469a53b4a7f322f5728744459ad4a8b733cb97044bd8b920c
-
SHA512
18bbeb6fbf7f7d34cc62ec4b532fe438f00610ba22f0c426a6a21a0417208d17b2f93dd4895694b2f2c13a4215555f692061055a97b49abf654b2ca6ea86db5e
-
SSDEEP
12288:yMroy90ZwYiF5t0SJ/l1A3Pi3vQsNO3xc+0Y/YSR+XsLHyD8G9+no7bv:uyXt0K4lH0YO8LHyZ9D
Static task
static1
Behavioral task
behavioral1
Sample
b23d9feeb8ab194469a53b4a7f322f5728744459ad4a8b733cb97044bd8b920c.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
redline
diza
83.97.73.129:19068
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Extracted
redline
sheron
83.97.73.129:19068
-
auth_value
2d067e7e2372227d3a03b335260112e9
Targets
-
-
Target
b23d9feeb8ab194469a53b4a7f322f5728744459ad4a8b733cb97044bd8b920c
-
Size
771KB
-
MD5
8f862685408fb0aa0630d6d720c454c0
-
SHA1
de56b0723eb0903d9c1f5a7bbe2e88d2c0790f18
-
SHA256
b23d9feeb8ab194469a53b4a7f322f5728744459ad4a8b733cb97044bd8b920c
-
SHA512
18bbeb6fbf7f7d34cc62ec4b532fe438f00610ba22f0c426a6a21a0417208d17b2f93dd4895694b2f2c13a4215555f692061055a97b49abf654b2ca6ea86db5e
-
SSDEEP
12288:yMroy90ZwYiF5t0SJ/l1A3Pi3vQsNO3xc+0Y/YSR+XsLHyD8G9+no7bv:uyXt0K4lH0YO8LHyZ9D
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-