General
-
Target
25d89569e1a25a6e08503d16758cb3c8d95fab993ddd98e5bf6ce713ed38c7e5
-
Size
670KB
-
Sample
230608-vz22tahb53
-
MD5
3c397e468ae4c11e7ab8fbb0d641848b
-
SHA1
d026ec46b899d93440a2a9f58de195a95eb6d543
-
SHA256
25d89569e1a25a6e08503d16758cb3c8d95fab993ddd98e5bf6ce713ed38c7e5
-
SHA512
4b46d56fe6014862df2c85e19b51b6b161a82ad466d07443bb833891810f7edd8a9bede2acb66cd4969079f6188d3ec2db501ffb1d3581bb3bb3e8a2f3a68cf0
-
SSDEEP
12288:0MrWy90ASCx2zkUbD3uRYDK4iWVBICjoLq60aFj6/SfiOW92B8ugIJ0HphY6:CyZbczzD3uRYuIwFhZFGIB2HphT
Static task
static1
Behavioral task
behavioral1
Sample
25d89569e1a25a6e08503d16758cb3c8d95fab993ddd98e5bf6ce713ed38c7e5.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
muha
83.97.73.129:19068
-
auth_value
3c237e5fecb41481b7af249e79828a46
Extracted
redline
crazy
83.97.73.129:19068
-
auth_value
66bc4d9682ea090eef64a299ece12fdd
Targets
-
-
Target
25d89569e1a25a6e08503d16758cb3c8d95fab993ddd98e5bf6ce713ed38c7e5
-
Size
670KB
-
MD5
3c397e468ae4c11e7ab8fbb0d641848b
-
SHA1
d026ec46b899d93440a2a9f58de195a95eb6d543
-
SHA256
25d89569e1a25a6e08503d16758cb3c8d95fab993ddd98e5bf6ce713ed38c7e5
-
SHA512
4b46d56fe6014862df2c85e19b51b6b161a82ad466d07443bb833891810f7edd8a9bede2acb66cd4969079f6188d3ec2db501ffb1d3581bb3bb3e8a2f3a68cf0
-
SSDEEP
12288:0MrWy90ASCx2zkUbD3uRYDK4iWVBICjoLq60aFj6/SfiOW92B8ugIJ0HphY6:CyZbczzD3uRYuIwFhZFGIB2HphT
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-