General
-
Target
95bc3b19f76b5fa77769091479b6333fe1e504e764db44d4fd1c12a0747c2b28
-
Size
713KB
-
Sample
230622-l1la1sdg45
-
MD5
c851840784695d2e7a907d16f40f0d93
-
SHA1
82d200a24ce80527a7fadfb574c685260cb8b7cf
-
SHA256
95bc3b19f76b5fa77769091479b6333fe1e504e764db44d4fd1c12a0747c2b28
-
SHA512
25b25b85ecc30f41c72c5bc51627fe34bed38f154166bc24ba328c6bdd96dd7822df194ae6194e353b7b941657325e94cd17b7684a397ba9392eceab080ce196
-
SSDEEP
12288:HcfztKeJjWeeIOZQEbWJSn/jVa5QL1iD1r7i/jZwXbGm6k/Z6VGtX3:Hskteebn/xsQBmi/jZwP6Ot
Static task
static1
Behavioral task
behavioral1
Sample
95bc3b19f76b5fa77769091479b6333fe1e504e764db44d4fd1c12a0747c2b28.exe
Resource
win10v2004-20230621-en
Malware Config
Extracted
redline
furga
83.97.73.128:19071
-
auth_value
1b7af6db7a79a3475798fcf494818be7
Extracted
amadey
3.84
77.91.68.63/doma/net/index.php
Targets
-
-
Target
95bc3b19f76b5fa77769091479b6333fe1e504e764db44d4fd1c12a0747c2b28
-
Size
713KB
-
MD5
c851840784695d2e7a907d16f40f0d93
-
SHA1
82d200a24ce80527a7fadfb574c685260cb8b7cf
-
SHA256
95bc3b19f76b5fa77769091479b6333fe1e504e764db44d4fd1c12a0747c2b28
-
SHA512
25b25b85ecc30f41c72c5bc51627fe34bed38f154166bc24ba328c6bdd96dd7822df194ae6194e353b7b941657325e94cd17b7684a397ba9392eceab080ce196
-
SSDEEP
12288:HcfztKeJjWeeIOZQEbWJSn/jVa5QL1iD1r7i/jZwXbGm6k/Z6VGtX3:Hskteebn/xsQBmi/jZwP6Ot
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-