General
-
Target
b2ce15fdc2b519d9a71fdc576dddd336a1b3a25335bc4ded9c8ec9120e92bbf1
-
Size
2.8MB
-
Sample
230722-ff4nzaac3s
-
MD5
4fee4dfe32401be36ab9d2f6e41f6228
-
SHA1
897fe7fb7242cc6ec4964183141a8f0c7d5f172e
-
SHA256
b2ce15fdc2b519d9a71fdc576dddd336a1b3a25335bc4ded9c8ec9120e92bbf1
-
SHA512
cb2f786ab00d7e1484cc977f56daf7e555909fdc7a9da14e0f541ef00b58fb8f78241c4cb79dccbe7d99cb7e772c3791d143346c1e75604e98176c121cb55c18
-
SSDEEP
49152:uxAUjfZ+AnOsIOyocA+YwZavG/Mfow7HSG5RXE10M97MKcGt6I69DpL9PlIvuyJt:Q9gAnWoR+YMav5oUb5RaBptoJpLjOJcw
Behavioral task
behavioral1
Sample
b2ce15fdc2b519d9a71fdc576dddd336a1b3a25335bc4ded9c8ec9120e92bbf1.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
b2ce15fdc2b519d9a71fdc576dddd336a1b3a25335bc4ded9c8ec9120e92bbf1.exe
Resource
win10-20230703-en
Malware Config
Extracted
redline
210723_rc_11
rcam21.tuktuk.ug:11290
-
auth_value
dd5c2e37dd240447def77d8a4c6244f5
Extracted
laplas
http://lpls.tuktuk.ug
-
api_key
a0f588021b58e0c7908a163f8750678efedf2a66bf739a12427b379aef47ccde
Targets
-
-
Target
b2ce15fdc2b519d9a71fdc576dddd336a1b3a25335bc4ded9c8ec9120e92bbf1
-
Size
2.8MB
-
MD5
4fee4dfe32401be36ab9d2f6e41f6228
-
SHA1
897fe7fb7242cc6ec4964183141a8f0c7d5f172e
-
SHA256
b2ce15fdc2b519d9a71fdc576dddd336a1b3a25335bc4ded9c8ec9120e92bbf1
-
SHA512
cb2f786ab00d7e1484cc977f56daf7e555909fdc7a9da14e0f541ef00b58fb8f78241c4cb79dccbe7d99cb7e772c3791d143346c1e75604e98176c121cb55c18
-
SSDEEP
49152:uxAUjfZ+AnOsIOyocA+YwZavG/Mfow7HSG5RXE10M97MKcGt6I69DpL9PlIvuyJt:Q9gAnWoR+YMav5oUb5RaBptoJpLjOJcw
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-