General
-
Target
slinkyloader.exe
-
Size
17.5MB
-
Sample
240421-tddlnaeh8w
-
MD5
96ea9220bae88a463930e138631c1983
-
SHA1
61bf5000860e49f3c70983922110c575d03e6f19
-
SHA256
369b5e6e18c6f1b494147389106008ee284eb20e448d57dd8fd814b05884e7a8
-
SHA512
36eb783f0b0e0101ca4b911c483fbf9e1d11c7ee08e51edabb83e61db79fb5ba781199e29e780555c69edf1fa4fac364b49519ceb7031ac086243b0952a87087
-
SSDEEP
393216:b+c50Fa7K39n0LHOz3tcA/YFspJfUXvakYHQFSdbhALSVQtikwtW3Jigc:Hot3uLuz3tM6rfUXCkYgU/VQti/W35
Static task
static1
Behavioral task
behavioral1
Sample
slinkyloader.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
redline
cheat
month-washer.gl.at.ply.gg:33498
Targets
-
-
Target
slinkyloader.exe
-
Size
17.5MB
-
MD5
96ea9220bae88a463930e138631c1983
-
SHA1
61bf5000860e49f3c70983922110c575d03e6f19
-
SHA256
369b5e6e18c6f1b494147389106008ee284eb20e448d57dd8fd814b05884e7a8
-
SHA512
36eb783f0b0e0101ca4b911c483fbf9e1d11c7ee08e51edabb83e61db79fb5ba781199e29e780555c69edf1fa4fac364b49519ceb7031ac086243b0952a87087
-
SSDEEP
393216:b+c50Fa7K39n0LHOz3tcA/YFspJfUXvakYHQFSdbhALSVQtikwtW3Jigc:Hot3uLuz3tM6rfUXCkYgU/VQti/W35
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SectopRAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-