General
-
Target
a587d721f8a9ae88a523b1d67f6a463b.exe
-
Size
599KB
-
Sample
230609-e1cwbaah89
-
MD5
a587d721f8a9ae88a523b1d67f6a463b
-
SHA1
410362a093366d280fc438f9c580f9f6ee787ac8
-
SHA256
63ff770c95394609a64e6a91f40b3a410d5fcce32d519b60195077f8ad948475
-
SHA512
56434ad71c1f41532b0259fdeb1857415e87bfaa32dbe25a7073a6881f103f2c0a7decf93e401c6477da9f2c8e1904da5f6dfb3645f0a86eb3e163ccd46033be
-
SSDEEP
12288:6MrPy90UZApZjOx6+3n73WdyahmdvyJVRlcIm0poY8ZKmeyS3NRo:1yAjB+373j+mRcR+//R8mvS3/o
Static task
static1
Behavioral task
behavioral1
Sample
a587d721f8a9ae88a523b1d67f6a463b.exe
Resource
win7-20230220-en
Malware Config
Extracted
redline
duha
83.97.73.129:19068
-
auth_value
aafe99874c3b8854069470882e00246c
Extracted
amadey
3.83
77.91.68.30/music/rock/index.php
Extracted
redline
crazy
83.97.73.129:19068
-
auth_value
66bc4d9682ea090eef64a299ece12fdd
Targets
-
-
Target
a587d721f8a9ae88a523b1d67f6a463b.exe
-
Size
599KB
-
MD5
a587d721f8a9ae88a523b1d67f6a463b
-
SHA1
410362a093366d280fc438f9c580f9f6ee787ac8
-
SHA256
63ff770c95394609a64e6a91f40b3a410d5fcce32d519b60195077f8ad948475
-
SHA512
56434ad71c1f41532b0259fdeb1857415e87bfaa32dbe25a7073a6881f103f2c0a7decf93e401c6477da9f2c8e1904da5f6dfb3645f0a86eb3e163ccd46033be
-
SSDEEP
12288:6MrPy90UZApZjOx6+3n73WdyahmdvyJVRlcIm0poY8ZKmeyS3NRo:1yAjB+373j+mRcR+//R8mvS3/o
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-