General
-
Target
file
-
Size
176KB
-
Sample
240522-af3h1sed73
-
MD5
b953eba523e77f6e19ec7a66e5babbad
-
SHA1
82dbe8304fa22decf94b5a96e5a19697fcbf57ec
-
SHA256
40a7b25cbc35c77604ac44d96e3cded8b29f3b5dd25c093550ae0629c7019ab1
-
SHA512
f4be970955f40caebb4c57612ba3ed3b1d6b921ad1561189483ae8072b375868b2e25bc9189e802e28f42be360b3979d322f79e6a80dcff87a3073fdb7897652
-
SSDEEP
1536:UijCa50ZoTgAJuHnjde83Ml83Mn1CyKBKyf6C9XS6zmFMtMd5/an/xlCv1aszFek:UiLgAkHnjPIQ6KSEX/+HuI4MU4
Static task
static1
Behavioral task
behavioral1
Sample
file.html
Resource
win11-20240508-en
Malware Config
Extracted
redline
@fgkyleoff
147.45.47.93:80
Targets
-
-
Target
file
-
Size
176KB
-
MD5
b953eba523e77f6e19ec7a66e5babbad
-
SHA1
82dbe8304fa22decf94b5a96e5a19697fcbf57ec
-
SHA256
40a7b25cbc35c77604ac44d96e3cded8b29f3b5dd25c093550ae0629c7019ab1
-
SHA512
f4be970955f40caebb4c57612ba3ed3b1d6b921ad1561189483ae8072b375868b2e25bc9189e802e28f42be360b3979d322f79e6a80dcff87a3073fdb7897652
-
SSDEEP
1536:UijCa50ZoTgAJuHnjde83Ml83Mn1CyKBKyf6C9XS6zmFMtMd5/an/xlCv1aszFek:UiLgAkHnjPIQ6KSEX/+HuI4MU4
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-