General
-
Target
e160bd6d351af7e2084b11de0e1c4a36.exe
-
Size
512KB
-
Sample
230703-gm296afa23
-
MD5
e160bd6d351af7e2084b11de0e1c4a36
-
SHA1
6349346994a986ffb2cd7cb32c38ee9a1b565b16
-
SHA256
01a8de42b34229a7b6966862f11f8c8422a1ce669949cf53dba7cf9cb3769199
-
SHA512
017e3af2ccab71173ffcad18c6a55ee7198f586d3872e8be74e02a85b5be172e81d4f8dc59e7cdb976bfb78cd32838c5742caa8dee156b637471aa09679e9578
-
SSDEEP
12288:VCiESQ2PBshcSBHwBWWgewDRSnLlFqy2x:VCiEC4YhwDR0rqy2x
Static task
static1
Behavioral task
behavioral1
Sample
e160bd6d351af7e2084b11de0e1c4a36.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
e160bd6d351af7e2084b11de0e1c4a36.exe
Resource
win10v2004-20230621-en
Malware Config
Extracted
redline
andre
77.91.124.49:19073
-
auth_value
8e5522dc6bdb7e288797bc46c2687b12
Extracted
amadey
3.84
77.91.68.63/doma/net/index.php
Targets
-
-
Target
e160bd6d351af7e2084b11de0e1c4a36.exe
-
Size
512KB
-
MD5
e160bd6d351af7e2084b11de0e1c4a36
-
SHA1
6349346994a986ffb2cd7cb32c38ee9a1b565b16
-
SHA256
01a8de42b34229a7b6966862f11f8c8422a1ce669949cf53dba7cf9cb3769199
-
SHA512
017e3af2ccab71173ffcad18c6a55ee7198f586d3872e8be74e02a85b5be172e81d4f8dc59e7cdb976bfb78cd32838c5742caa8dee156b637471aa09679e9578
-
SSDEEP
12288:VCiESQ2PBshcSBHwBWWgewDRSnLlFqy2x:VCiEC4YhwDR0rqy2x
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-