General
-
Target
3eaf05281edd69952c5d4f6aa7eb9905.exe
-
Size
816KB
-
Sample
230614-q6dwcahg34
-
MD5
3eaf05281edd69952c5d4f6aa7eb9905
-
SHA1
56095a4e628c57dbb888d01005f7df46d3579cae
-
SHA256
385a86f6367cfd1e2b27d4440f0eb3085f3f9a13ba5e068afc92c754b54c1185
-
SHA512
ee8b4588c233a752d6c220685e0b7182b8528520a77453c87fde16208b944795cf219a0b290efdc94400570d445316419a9f3115960df4e0ff5c812ebd1862b6
-
SSDEEP
12288:hMrXy90/7MvMxFsBlSWXBY+Iyg4iIO5Gcu00riDMSvRO9/x2G9xPbjuCAZss:6yYULaHSlORuL2MGR+NxPbjuCA
Static task
static1
Behavioral task
behavioral1
Sample
3eaf05281edd69952c5d4f6aa7eb9905.exe
Resource
win7-20230220-en
Malware Config
Extracted
redline
rovno
83.97.73.130:19061
-
auth_value
88306b072bfae0d9e44ed86a222b439d
Extracted
redline
maxi
83.97.73.130:19061
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Extracted
amadey
3.84
77.91.68.63/doma/net/index.php
Targets
-
-
Target
3eaf05281edd69952c5d4f6aa7eb9905.exe
-
Size
816KB
-
MD5
3eaf05281edd69952c5d4f6aa7eb9905
-
SHA1
56095a4e628c57dbb888d01005f7df46d3579cae
-
SHA256
385a86f6367cfd1e2b27d4440f0eb3085f3f9a13ba5e068afc92c754b54c1185
-
SHA512
ee8b4588c233a752d6c220685e0b7182b8528520a77453c87fde16208b944795cf219a0b290efdc94400570d445316419a9f3115960df4e0ff5c812ebd1862b6
-
SSDEEP
12288:hMrXy90/7MvMxFsBlSWXBY+Iyg4iIO5Gcu00riDMSvRO9/x2G9xPbjuCAZss:6yYULaHSlORuL2MGR+NxPbjuCA
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-