General
-
Target
5f3aeb71b5f03a122bce55ffc079fa63.exe
-
Size
459KB
-
Sample
240522-mfztcabh4t
-
MD5
5f3aeb71b5f03a122bce55ffc079fa63
-
SHA1
7da4b04cdffec1f387fa7d50eac7c4dbe64681e1
-
SHA256
ed1f4a8961cde79aa59e209eb348d04b4638cb2807ff98f0207308a2d4d77e7f
-
SHA512
2d8adfdf2199d07183d8e27ef6f34e6e8ce4382cc03b1d5a2411f3bdb2d8d95f400db45d354da004b091bee5019298600c6311c5656aa8768c07ebee3ace53ad
-
SSDEEP
12288:R0Y+KFcYutMMY38PhZ65yqirG2HGdcT1IbwlN6up:2uMY3gZ6dYYrbwlNlp
Static task
static1
Behavioral task
behavioral1
Sample
5f3aeb71b5f03a122bce55ffc079fa63.exe
Resource
win7-20240508-en
Malware Config
Extracted
redline
@OLEH_PSP
185.172.128.33:8970
Targets
-
-
Target
5f3aeb71b5f03a122bce55ffc079fa63.exe
-
Size
459KB
-
MD5
5f3aeb71b5f03a122bce55ffc079fa63
-
SHA1
7da4b04cdffec1f387fa7d50eac7c4dbe64681e1
-
SHA256
ed1f4a8961cde79aa59e209eb348d04b4638cb2807ff98f0207308a2d4d77e7f
-
SHA512
2d8adfdf2199d07183d8e27ef6f34e6e8ce4382cc03b1d5a2411f3bdb2d8d95f400db45d354da004b091bee5019298600c6311c5656aa8768c07ebee3ace53ad
-
SSDEEP
12288:R0Y+KFcYutMMY38PhZ65yqirG2HGdcT1IbwlN6up:2uMY3gZ6dYYrbwlNlp
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-