General
-
Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbXNVRVVRWHFNT3p3N2owUXc0RXBDN3Z4Y25JUXxBQ3Jtc0ttRFBEakRFMHJ4YlY1SllkMTI2Qmx5V2xQN3pseUN6eUcyZzZyb3dHejNpZThUTm9nLUJQakZFWVFQQTBjcGI0d2RnQ2NEallKUm5qU1YyMzdOdUFDcUpzVmw5ZXpTYS1jZXN2MTc0WFdjR0xjVU5Qbw&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fv29nva4zio2as%2FGMS&v=8z0_rh3V1u8
-
Sample
240206-r3zt3sbbgm
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbXNVRVVRWHFNT3p3N2owUXc0RXBDN3Z4Y25JUXxBQ3Jtc0ttRFBEakRFMHJ4YlY1SllkMTI2Qmx5V2xQN3pseUN6eUcyZzZyb3dHejNpZThUTm9nLUJQakZFWVFQQTBjcGI0d2RnQ2NEallKUm5qU1YyMzdOdUFDcUpzVmw5ZXpTYS1jZXN2MTc0WFdjR0xjVU5Qbw&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fv29nva4zio2as%2FGMS&v=8z0_rh3V1u8
Resource
win11-20231215-en
Malware Config
Extracted
redline
45.15.156.142:33597
Targets
-
-
Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbXNVRVVRWHFNT3p3N2owUXc0RXBDN3Z4Y25JUXxBQ3Jtc0ttRFBEakRFMHJ4YlY1SllkMTI2Qmx5V2xQN3pseUN6eUcyZzZyb3dHejNpZThUTm9nLUJQakZFWVFQQTBjcGI0d2RnQ2NEallKUm5qU1YyMzdOdUFDcUpzVmw5ZXpTYS1jZXN2MTc0WFdjR0xjVU5Qbw&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fv29nva4zio2as%2FGMS&v=8z0_rh3V1u8
Score10/10-
Detect Poverty Stealer Payload
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-