General
-
Target
eddabd7003448893605419c3e0431dddc2e66780da89a8169a629a01e82c8b02
-
Size
713KB
-
Sample
230622-n97aysec35
-
MD5
5cac5a46bd37ac816e34b063382d694e
-
SHA1
f93cf3c0df755ee6306b719ac34fa64834a0996c
-
SHA256
eddabd7003448893605419c3e0431dddc2e66780da89a8169a629a01e82c8b02
-
SHA512
9efb7fad771b032cd38bc32e961ae9a6283d01ec00dc98eec20c71287ecac792a6eeebcbbe747bcd7016576fdbfa8ab362864f1a42c06510898d46914bacc136
-
SSDEEP
12288:dztKe5jWeeIOat1kWJSn/haGJPa5T6Fdz8AQsNvdieLlwShwkbAZH:dk9eenn/oGJ1dRNlicwSek+
Static task
static1
Behavioral task
behavioral1
Sample
eddabd7003448893605419c3e0431dddc2e66780da89a8169a629a01e82c8b02.exe
Resource
win10v2004-20230621-en
Malware Config
Extracted
redline
furga
83.97.73.128:19071
-
auth_value
1b7af6db7a79a3475798fcf494818be7
Extracted
amadey
3.84
77.91.68.63/doma/net/index.php
Targets
-
-
Target
eddabd7003448893605419c3e0431dddc2e66780da89a8169a629a01e82c8b02
-
Size
713KB
-
MD5
5cac5a46bd37ac816e34b063382d694e
-
SHA1
f93cf3c0df755ee6306b719ac34fa64834a0996c
-
SHA256
eddabd7003448893605419c3e0431dddc2e66780da89a8169a629a01e82c8b02
-
SHA512
9efb7fad771b032cd38bc32e961ae9a6283d01ec00dc98eec20c71287ecac792a6eeebcbbe747bcd7016576fdbfa8ab362864f1a42c06510898d46914bacc136
-
SSDEEP
12288:dztKe5jWeeIOat1kWJSn/haGJPa5T6Fdz8AQsNvdieLlwShwkbAZH:dk9eenn/oGJ1dRNlicwSek+
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-