General
-
Target
a86f3485b85546e0f5e5a0991e2fab52a8aad5be9247ac918d38d1007bff2d7a
-
Size
583KB
-
Sample
230616-nakb5sef66
-
MD5
e797af2711d8659972227c374faf01aa
-
SHA1
a22a5cb59e17b6249f5e1467df61c211e63314d1
-
SHA256
a86f3485b85546e0f5e5a0991e2fab52a8aad5be9247ac918d38d1007bff2d7a
-
SHA512
97d392427f65875e95e53b8f0634df344e7f7862870fe46631e3b38e9501eaf4664898d694b1e17abc4df062a355833f0b1404a50efa0166b2afb06c05dfe9d5
-
SSDEEP
12288:TMrCy90P6ILt3oAxD1Bw6mwOZuzjx4RNeiEzHq2W4wl9isk:dyn2OY15W0zGveTI48hk
Static task
static1
Malware Config
Extracted
redline
dana
83.97.73.130:19061
-
auth_value
da2d1691db653e49676d799e1eae2673
Extracted
amadey
3.84
77.91.68.63/doma/net/index.php
Extracted
redline
joker
83.97.73.130:19061
-
auth_value
a98d303cc28bb3b32a23c59214ae3bc0
Targets
-
-
Target
a86f3485b85546e0f5e5a0991e2fab52a8aad5be9247ac918d38d1007bff2d7a
-
Size
583KB
-
MD5
e797af2711d8659972227c374faf01aa
-
SHA1
a22a5cb59e17b6249f5e1467df61c211e63314d1
-
SHA256
a86f3485b85546e0f5e5a0991e2fab52a8aad5be9247ac918d38d1007bff2d7a
-
SHA512
97d392427f65875e95e53b8f0634df344e7f7862870fe46631e3b38e9501eaf4664898d694b1e17abc4df062a355833f0b1404a50efa0166b2afb06c05dfe9d5
-
SSDEEP
12288:TMrCy90P6ILt3oAxD1Bw6mwOZuzjx4RNeiEzHq2W4wl9isk:dyn2OY15W0zGveTI48hk
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-