redline

General

Target
CS2 Cheat.zip
Size 20.6MB
Sample240531-tkf1cseb66
SHA256 2de2134a2b6d2c8aeb45c4c4223402d01417a61e9a81b8dd078393f5e9c7c938
MD5 ec71be0e52f95207f4227e7d9798e56d
SHA1 9ffdd41bf1941dba04adf2e2e8c8c8053f8ffab7
SHA512 ffde637eaa0f8984006f8c880c9ada052482d821e70f9c623ce144f5ccd97e276a97388ae53294b08f2fc557fac57098e4eb74ed3866bb6aae11784af431a5b4
SSDEEP 393216:1KEceN11vb36Oggj3FthnwToDEv1RCZLMAy2RPJSL8ZANiePompCXHGJZQSxcb3+:ZrN1pqOhJwoDMmLMAyJL4AFpSgZlCb65
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  SoftWare(1).exe
- Size 462KB
- SHA256 4a543f647d662ad43b70f3fa7171aa2f73842f3c132eb54c0acc88802bd66275
- MD5 785f8009ad61ad2564df3ff47eb54c8f
- SHA1 6ee6a0c06897e559f7302ed28ba9002639f95598
- SHA512 aada532b660d3dce0b4e08b54170741d0cd16c5426107f61be2c1b50754c87ce5373734fe552ae19e6ab4c2726ba9e3393672e009c77d0f871eeebc6acc964df
- SSDEEP 6144:H/loNDtJ/rTQMHrFGOqZbR7AY1o9WWHyqvJtWxJ+jB8wDZSYTtiX2I2l3mIjsVEq:yNRJ/oMPweyqGa8wPekgIjsCkDUC
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

redline discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  SoftWare(2).exe
- Size 661KB
- SHA256 5c57edb28b3cf41ef9265526740b2a81e9520a78e91ab501f0df4fadfb6bc354
- MD5 17d75ebe6ab295ad907e5699d839f642
- SHA1 8c8b0537bb8e891c204579d2360b3334df5b9d41
- SHA512 f70cf2ab84b247be1999da0393eb7507b63068fa3ea195539c6d3ff0a80a4d73b95e870be882b41e3722b9d49b583fd10064c27c7477115883579909b6eac310
- SSDEEP 12288:ri5/sTwln7RfpWCp6JNnBrtPpNkT+d7Q8S5wXHCdFhGkHniV/QEuUC:2RsGn7RxWoa5hNWixiduSED
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral3 behavioral4