General
-
Target
7ed474707b5c8adc5843b7d95647c9d93773d49ab9bc005034b909ff953008d1
-
Size
735KB
-
Sample
230616-m45phaec8v
-
MD5
866e3835cf47eaba59809018440ae869
-
SHA1
c62faad6837dc6ff2885642de240273acd5b02f9
-
SHA256
7ed474707b5c8adc5843b7d95647c9d93773d49ab9bc005034b909ff953008d1
-
SHA512
620364931483b83ae0aa8454c28110eddab5010c54484225575e38baf4f6e02fb8a93d92792ecb4649470d4fe3c9fd6b7e0aaa28a1ff097c8fbeae4f8681b1d3
-
SSDEEP
12288:5Mr4y90opgOm7Rom6+F80+GSJ5TBzFv2bGL8ytfzZ2ghsFZ7QwLASoM8aX:RydSOCOJ1T2bGw6N28shUSz8q
Static task
static1
Malware Config
Extracted
redline
dana
83.97.73.130:19061
-
auth_value
da2d1691db653e49676d799e1eae2673
Extracted
amadey
3.84
77.91.68.63/doma/net/index.php
Extracted
redline
joker
83.97.73.130:19061
-
auth_value
a98d303cc28bb3b32a23c59214ae3bc0
Targets
-
-
Target
7ed474707b5c8adc5843b7d95647c9d93773d49ab9bc005034b909ff953008d1
-
Size
735KB
-
MD5
866e3835cf47eaba59809018440ae869
-
SHA1
c62faad6837dc6ff2885642de240273acd5b02f9
-
SHA256
7ed474707b5c8adc5843b7d95647c9d93773d49ab9bc005034b909ff953008d1
-
SHA512
620364931483b83ae0aa8454c28110eddab5010c54484225575e38baf4f6e02fb8a93d92792ecb4649470d4fe3c9fd6b7e0aaa28a1ff097c8fbeae4f8681b1d3
-
SSDEEP
12288:5Mr4y90opgOm7Rom6+F80+GSJ5TBzFv2bGL8ytfzZ2ghsFZ7QwLASoM8aX:RydSOCOJ1T2bGw6N28shUSz8q
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-