General
-
Target
tmp
-
Size
757KB
-
Sample
230609-zvl71sde46
-
MD5
aeb5a58cddf2a07f03cc8fe2a2f6f61e
-
SHA1
16efe6d0e428ef10b27831ae53e750ee26d9bef0
-
SHA256
fe853c3979dda3ab658d596814eeb089b1b977017606d9e9a25a2f85a543b453
-
SHA512
f62a239e32c0bd13cb39496e4fa91965c71dddcd754d435f28e6ceee9834b1de91e1d6487d608b07f0c29847c4a57cdf792ad937f01e4a6f9a8a6d1f79ff4c29
-
SSDEEP
12288:vMryy90YKlt3n7ge8gdOJ9vOdMVp1Flxs8kldqXzkNh79rakvkm4ocz:xyton1SOSH1O8kXNh79rakMm9u
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
Malware Config
Extracted
redline
duha
83.97.73.129:19068
-
auth_value
aafe99874c3b8854069470882e00246c
Extracted
amadey
3.83
77.91.68.30/music/rock/index.php
Extracted
redline
crazy
83.97.73.129:19068
-
auth_value
66bc4d9682ea090eef64a299ece12fdd
Targets
-
-
Target
tmp
-
Size
757KB
-
MD5
aeb5a58cddf2a07f03cc8fe2a2f6f61e
-
SHA1
16efe6d0e428ef10b27831ae53e750ee26d9bef0
-
SHA256
fe853c3979dda3ab658d596814eeb089b1b977017606d9e9a25a2f85a543b453
-
SHA512
f62a239e32c0bd13cb39496e4fa91965c71dddcd754d435f28e6ceee9834b1de91e1d6487d608b07f0c29847c4a57cdf792ad937f01e4a6f9a8a6d1f79ff4c29
-
SSDEEP
12288:vMryy90YKlt3n7ge8gdOJ9vOdMVp1Flxs8kldqXzkNh79rakvkm4ocz:xyton1SOSH1O8kXNh79rakMm9u
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-