General
-
Target
3a8729cbe2daf4785b30c6d46a6cc0f40163043c03505e6076e0d1a5d0211740
-
Size
773KB
-
Sample
241111-a7p21asjgr
-
MD5
485b06bc9a3ac16588097672635ffd46
-
SHA1
a0f420dacf8a9a83f95c6be136ee04c0a8de62ad
-
SHA256
3a8729cbe2daf4785b30c6d46a6cc0f40163043c03505e6076e0d1a5d0211740
-
SHA512
bb290e1bf14bf3c04738a594e24802daaedc829eaace7cd5cecb60969fa5e0b165271d528dfa56a6beb8879ffd499080919d088a0589d5b4bb67853b6d386f11
-
SSDEEP
12288:ty900dscD1pwKp6vK8dZoAM8g6xDBk/e/W8LXwsesZ/7j4Jbp9vQkzfrE/+8:tytGcD1DIvKCLfxV8sHTjqmj
Static task
static1
Behavioral task
behavioral1
Sample
3a8729cbe2daf4785b30c6d46a6cc0f40163043c03505e6076e0d1a5d0211740.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dante
185.161.248.73:4164
-
auth_value
f4066af6b8a6f23125c8ee48288a3f90
Targets
-
-
Target
3a8729cbe2daf4785b30c6d46a6cc0f40163043c03505e6076e0d1a5d0211740
-
Size
773KB
-
MD5
485b06bc9a3ac16588097672635ffd46
-
SHA1
a0f420dacf8a9a83f95c6be136ee04c0a8de62ad
-
SHA256
3a8729cbe2daf4785b30c6d46a6cc0f40163043c03505e6076e0d1a5d0211740
-
SHA512
bb290e1bf14bf3c04738a594e24802daaedc829eaace7cd5cecb60969fa5e0b165271d528dfa56a6beb8879ffd499080919d088a0589d5b4bb67853b6d386f11
-
SSDEEP
12288:ty900dscD1pwKp6vK8dZoAM8g6xDBk/e/W8LXwsesZ/7j4Jbp9vQkzfrE/+8:tytGcD1DIvKCLfxV8sHTjqmj
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-