General
-
Target
virussign.com_9e05db7b8e2ea797ad9623e79199d9a0.vir
-
Size
569KB
-
Sample
240602-ww87dsad4x
-
MD5
9e05db7b8e2ea797ad9623e79199d9a0
-
SHA1
4a7f37b35994f96880957694d696250d21e6401c
-
SHA256
b2b7dc53ed3828add24f2cca1411273ec7636a343d0269ae69d75303963bf825
-
SHA512
0a1fdbd4e64a4a1b0f5e24f6062a0fdfafc3a7aba1d2706c35b1c2325ddb9f5d3a2da789d57932579b0866e5c50c4b1630c1b7effbb219458352d72b04db8129
-
SSDEEP
12288:q+gbw3+dJS4VZzLs13tG8AI1QE3HzgeU33pfy/lDtkarsXMWNMkR:F/38ScZk13MXIS2T8pYD8pN7
Static task
static1
Behavioral task
behavioral1
Sample
virussign.com_9e05db7b8e2ea797ad9623e79199d9a0.exe
Resource
win7-20240221-en
Malware Config
Extracted
redline
cheat
45.137.22.243:55615
Targets
-
-
Target
virussign.com_9e05db7b8e2ea797ad9623e79199d9a0.vir
-
Size
569KB
-
MD5
9e05db7b8e2ea797ad9623e79199d9a0
-
SHA1
4a7f37b35994f96880957694d696250d21e6401c
-
SHA256
b2b7dc53ed3828add24f2cca1411273ec7636a343d0269ae69d75303963bf825
-
SHA512
0a1fdbd4e64a4a1b0f5e24f6062a0fdfafc3a7aba1d2706c35b1c2325ddb9f5d3a2da789d57932579b0866e5c50c4b1630c1b7effbb219458352d72b04db8129
-
SSDEEP
12288:q+gbw3+dJS4VZzLs13tG8AI1QE3HzgeU33pfy/lDtkarsXMWNMkR:F/38ScZk13MXIS2T8pYD8pN7
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SectopRAT payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-