General
-
Target
679d5cdadcc48fa79574ce12e8d0fd2e19823dc4b7e39a84b5b286672f45a72d.zip
-
Size
1.6MB
-
Sample
240402-mkenzaeh7x
-
MD5
4e6e7cf50137dcd489971f303c0b6990
-
SHA1
64a484485a319097fad9392693f2c721f5e90509
-
SHA256
7cab11b80a8ac4552abc1f0121ec1dbf3f33816468e2c0826dfee174d27b9204
-
SHA512
c332ff0b685efeecb6d07a2dda0ba005d2fb02e45dab5de62fef6d8c8d6be852f907990754f26088315d8d03da40cc9490aec170f22413e576dc8d5b2c04017a
-
SSDEEP
24576:nxZoIpi96aF0qmIWGoEqFk1da5lr72rIXxVAcSNROSkRzd+Ec2cjtC1iQeFn:n69QYvSadcr7rXx+f/URzd+Vjs/el
Static task
static1
Behavioral task
behavioral1
Sample
679d5cdadcc48fa79574ce12e8d0fd2e19823dc4b7e39a84b5b286672f45a72d.exe
Resource
win7-20240221-en
Malware Config
Extracted
redline
1
77.221.156.45:18734
Targets
-
-
Target
679d5cdadcc48fa79574ce12e8d0fd2e19823dc4b7e39a84b5b286672f45a72d.exe
-
Size
1.9MB
-
MD5
1a933b075452db624a756f76662a0614
-
SHA1
264bedf3867851461ea52b75650f414fcebb61ef
-
SHA256
679d5cdadcc48fa79574ce12e8d0fd2e19823dc4b7e39a84b5b286672f45a72d
-
SHA512
8f84c2c548d5774c5e942cef1dc5e0eb6e82a79d22a30b636bf0a98fad535cfab5e77a380c1c167ea33caca1ee397e64490eff0672cc915d1c8e797eb63e1071
-
SSDEEP
24576:GubsnafAPyjSzuubsnafAPyjZrilCQZCC3kmnrAa1rmqUeIiVfox2oTVZHeBFpUH:YI4wI1iln73XnrA0dqiFoHcpfi/Znqh0
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-