General
-
Target
30ba5e65d50eec050a3a367ddc885176866e666ef3bbfad0069db77eaa90b5a6
-
Size
504KB
-
Sample
240725-q2hzha1hkj
-
MD5
976c60b82a4dfb6441e0c39b7e2725f2
-
SHA1
11a807a614386017a4cae2bd557410f1cee9b975
-
SHA256
30ba5e65d50eec050a3a367ddc885176866e666ef3bbfad0069db77eaa90b5a6
-
SHA512
b1d3f218d58c4f9e62d23453330c334246fdbd460b657c02353ccdff636a5ca5eea0d4d7da5658abfb00dd446a37f9d2945b29592bf273ed22ae07078ee60083
-
SSDEEP
12288:pCKcU5h7YQMDavierlJMa27XLkPjnqR19vV3c:vcoZYQn5pJMqn0vV3c
Static task
static1
Behavioral task
behavioral1
Sample
30ba5e65d50eec050a3a367ddc885176866e666ef3bbfad0069db77eaa90b5a6.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
30ba5e65d50eec050a3a367ddc885176866e666ef3bbfad0069db77eaa90b5a6.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
redline
cheat
185.222.57.147:55615
Targets
-
-
Target
30ba5e65d50eec050a3a367ddc885176866e666ef3bbfad0069db77eaa90b5a6
-
Size
504KB
-
MD5
976c60b82a4dfb6441e0c39b7e2725f2
-
SHA1
11a807a614386017a4cae2bd557410f1cee9b975
-
SHA256
30ba5e65d50eec050a3a367ddc885176866e666ef3bbfad0069db77eaa90b5a6
-
SHA512
b1d3f218d58c4f9e62d23453330c334246fdbd460b657c02353ccdff636a5ca5eea0d4d7da5658abfb00dd446a37f9d2945b29592bf273ed22ae07078ee60083
-
SSDEEP
12288:pCKcU5h7YQMDavierlJMa27XLkPjnqR19vV3c:vcoZYQn5pJMqn0vV3c
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SectopRAT payload
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-