General
-
Target
c09b61a69155a6b2dd50d28572a03b69bc7684150cb8d32e8d10c79442f3b178
-
Size
583KB
-
Sample
230616-mrebsaec2y
-
MD5
dd1fd073b9a98b57e634ba6ede4605d6
-
SHA1
1ace70897f94bf6405de8a3a1fe8ada8ed9ce6e7
-
SHA256
c09b61a69155a6b2dd50d28572a03b69bc7684150cb8d32e8d10c79442f3b178
-
SHA512
ada3c613179634934dc937e1243f429063fdacebdbbe283c0e9237b81ff8546c77fb3df1b7a00112a2af97f06104600ec850b496d84ffd54202d5f01d3d67766
-
SSDEEP
12288:gMr2y90zfFFdGhvzzXEyHPX4L3/1ksRm+31B9U4vJsd:Gy+PdQvP1PX4jo+31Jid
Static task
static1
Malware Config
Extracted
redline
dana
83.97.73.130:19061
-
auth_value
da2d1691db653e49676d799e1eae2673
Extracted
amadey
3.84
77.91.68.63/doma/net/index.php
Extracted
redline
joker
83.97.73.130:19061
-
auth_value
a98d303cc28bb3b32a23c59214ae3bc0
Targets
-
-
Target
c09b61a69155a6b2dd50d28572a03b69bc7684150cb8d32e8d10c79442f3b178
-
Size
583KB
-
MD5
dd1fd073b9a98b57e634ba6ede4605d6
-
SHA1
1ace70897f94bf6405de8a3a1fe8ada8ed9ce6e7
-
SHA256
c09b61a69155a6b2dd50d28572a03b69bc7684150cb8d32e8d10c79442f3b178
-
SHA512
ada3c613179634934dc937e1243f429063fdacebdbbe283c0e9237b81ff8546c77fb3df1b7a00112a2af97f06104600ec850b496d84ffd54202d5f01d3d67766
-
SSDEEP
12288:gMr2y90zfFFdGhvzzXEyHPX4L3/1ksRm+31B9U4vJsd:Gy+PdQvP1PX4jo+31Jid
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-