General
- Target Setup.exe
- Size 7.1MB
- Sample231123-ypaflabh39
- SHA256 ed53c20f0d55834a573d7303e9ed64242568ae139b06cdbcac9bd173d0d23c0a
- MD5 655c9ab59afafdcc3c3ea06fe256c716
- SHA1 f9689d55005562013f98fbbc9cbb92d2c6016033
- SHA512 a563a21f1266566a7b85de12912a9fb69ef8c602c73764632a745fae7407de5f876c30ca7b21864488f089fee32c3418d36590e0e631835085bc8563762366c5
- SSDEEP 49152:q7Nx5ZBZQgqykOKQrb/TvvO90d7HjmAFd4A64nsfJIkLPXdsvn30By+GaF9lhLQT:LgqeKxPXco3/Xxt1EF+CqLj4Vv
- MD5 SHA1 SHA512 SSDEEP
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20231025-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20231025-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target Setup.exe
- Size 7.1MB
- SHA256 ed53c20f0d55834a573d7303e9ed64242568ae139b06cdbcac9bd173d0d23c0a
- MD5 655c9ab59afafdcc3c3ea06fe256c716
- SHA1 f9689d55005562013f98fbbc9cbb92d2c6016033
- SHA512 a563a21f1266566a7b85de12912a9fb69ef8c602c73764632a745fae7407de5f876c30ca7b21864488f089fee32c3418d36590e0e631835085bc8563762366c5
- SSDEEP 49152:q7Nx5ZBZQgqykOKQrb/TvvO90d7HjmAFd4A64nsfJIkLPXdsvn30By+GaF9lhLQT:LgqeKxPXco3/Xxt1EF+CqLj4Vv
- MD5 SHA1 SHA512 SSDEEP
Score10/10RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
RedLine payload
Accesses cryptocurrency files/wallets, possible credential harvesting
Suspicious use of SetThreadContext