General
-
Target
29b7725be3b7300dda4b8c3e6c55e55ade1129e87767a.exe
-
Size
786KB
-
Sample
230615-je8s3sfb27
-
MD5
763e66970b3e0db8db7aaee68e2a1899
-
SHA1
cf4c915b4fe79e3e842871bdd0cbeb975b5735a5
-
SHA256
29b7725be3b7300dda4b8c3e6c55e55ade1129e87767ae8eec03fbb5fd863858
-
SHA512
851f8e21b5270757356bac799c800be6f13d1644114471cb6236e3c117abf69bd52a5716fe11bd4f8009c4f1b818edca1ef488d7cc07fe4c7fd0aaa17b92e8f4
-
SSDEEP
24576:Wyri1/eRkj146QefjvmmA8Xdv8d85mt4h9Ki:lrqmAl9mmAum2r
Static task
static1
Behavioral task
behavioral1
Sample
29b7725be3b7300dda4b8c3e6c55e55ade1129e87767a.exe
Resource
win7-20230220-en
Malware Config
Extracted
redline
rovno
83.97.73.130:19061
-
auth_value
88306b072bfae0d9e44ed86a222b439d
Extracted
redline
maxi
83.97.73.130:19061
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Extracted
amadey
3.84
77.91.68.63/doma/net/index.php
Targets
-
-
Target
29b7725be3b7300dda4b8c3e6c55e55ade1129e87767a.exe
-
Size
786KB
-
MD5
763e66970b3e0db8db7aaee68e2a1899
-
SHA1
cf4c915b4fe79e3e842871bdd0cbeb975b5735a5
-
SHA256
29b7725be3b7300dda4b8c3e6c55e55ade1129e87767ae8eec03fbb5fd863858
-
SHA512
851f8e21b5270757356bac799c800be6f13d1644114471cb6236e3c117abf69bd52a5716fe11bd4f8009c4f1b818edca1ef488d7cc07fe4c7fd0aaa17b92e8f4
-
SSDEEP
24576:Wyri1/eRkj146QefjvmmA8Xdv8d85mt4h9Ki:lrqmAl9mmAum2r
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-