General
-
Target
65bd17c560cd153e6cf95a46da3235b171dcdcebd042a49443ff3c3068ba0711
-
Size
865KB
-
Sample
231011-fjr5caaf3v
-
MD5
4d113fa36d8870ea3a4bdab579fad637
-
SHA1
db5550335e99d36b6b350bbfa5d10d42cfd9903c
-
SHA256
65bd17c560cd153e6cf95a46da3235b171dcdcebd042a49443ff3c3068ba0711
-
SHA512
29c644c9d09624a31d8e72622b6e65bbb4ed945697067d856314276ef20694487dbb3505916a01d724a52788799f081d97c0a998a2c71e02942a2b30212e1eff
-
SSDEEP
24576:dyJw5n0ZJBHZlpJqUrB8mw0xLJA+kXFAYcjp2e9BxgOGC3:4Jwh0ZJF7pdBTL25qHc1OGC
Static task
static1
Behavioral task
behavioral1
Sample
65bd17c560cd153e6cf95a46da3235b171dcdcebd042a49443ff3c3068ba0711.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
65bd17c560cd153e6cf95a46da3235b171dcdcebd042a49443ff3c3068ba0711.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Targets
-
-
Target
65bd17c560cd153e6cf95a46da3235b171dcdcebd042a49443ff3c3068ba0711
-
Size
865KB
-
MD5
4d113fa36d8870ea3a4bdab579fad637
-
SHA1
db5550335e99d36b6b350bbfa5d10d42cfd9903c
-
SHA256
65bd17c560cd153e6cf95a46da3235b171dcdcebd042a49443ff3c3068ba0711
-
SHA512
29c644c9d09624a31d8e72622b6e65bbb4ed945697067d856314276ef20694487dbb3505916a01d724a52788799f081d97c0a998a2c71e02942a2b30212e1eff
-
SSDEEP
24576:dyJw5n0ZJBHZlpJqUrB8mw0xLJA+kXFAYcjp2e9BxgOGC3:4Jwh0ZJF7pdBTL25qHc1OGC
-
Detect Mystic stealer payload
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-