General
-
Target
16ef72ba04616a79468d2c57a8f7213c1d8390a331f3da27cd1fd571488081fe
-
Size
678KB
-
Sample
230622-s6t9fafb74
-
MD5
42988edb1ac2a454f91add0b152b4359
-
SHA1
0bba211b3cd639148ab6e8da45005340796cf4f8
-
SHA256
16ef72ba04616a79468d2c57a8f7213c1d8390a331f3da27cd1fd571488081fe
-
SHA512
970298b07dc58d326097bd1909f2edc6d8e50ecb1d1c7ffed26b7a328753e5dd1fc3efe4fee68816826d9180bf75ecbc67d802bffb543d07363ae69944e96ef7
-
SSDEEP
12288:VjztKe5jWeeIO5yzPWJSn/IDqYculUS85RKmhbD+ikQzg/c:Fk9ee+n/IWYmS8yLi7+
Static task
static1
Behavioral task
behavioral1
Sample
16ef72ba04616a79468d2c57a8f7213c1d8390a331f3da27cd1fd571488081fe.exe
Resource
win10v2004-20230621-en
Malware Config
Extracted
redline
furga
83.97.73.128:19071
-
auth_value
1b7af6db7a79a3475798fcf494818be7
Extracted
amadey
3.84
77.91.68.63/doma/net/index.php
Targets
-
-
Target
16ef72ba04616a79468d2c57a8f7213c1d8390a331f3da27cd1fd571488081fe
-
Size
678KB
-
MD5
42988edb1ac2a454f91add0b152b4359
-
SHA1
0bba211b3cd639148ab6e8da45005340796cf4f8
-
SHA256
16ef72ba04616a79468d2c57a8f7213c1d8390a331f3da27cd1fd571488081fe
-
SHA512
970298b07dc58d326097bd1909f2edc6d8e50ecb1d1c7ffed26b7a328753e5dd1fc3efe4fee68816826d9180bf75ecbc67d802bffb543d07363ae69944e96ef7
-
SSDEEP
12288:VjztKe5jWeeIO5yzPWJSn/IDqYculUS85RKmhbD+ikQzg/c:Fk9ee+n/IWYmS8yLi7+
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-