General
-
Target
ebacaba15518ab84674beaef6fbb88fb978d3954394e47abc947202e3ec2abe4
-
Size
850KB
-
Sample
241111-by26msyndy
-
MD5
059b328d369e1c3d9b0034a92076c723
-
SHA1
ebdb66121654329d3c8785916bd481289fe9177b
-
SHA256
ebacaba15518ab84674beaef6fbb88fb978d3954394e47abc947202e3ec2abe4
-
SHA512
230c60c69857a1a4051d6d32c8629f1871a1ab624d2158ffd45383fcf601642b7c518b8d657d7f36eca2de96dbf5094d15f3be4265fdf355480c8edf093b625c
-
SSDEEP
24576:Tyaq8Rr8e6EE8Ch3W0ziCXEFP48QeFwkGPSakrpvq7:mQr8e9pgqCULTFh8Sakrpvq
Static task
static1
Behavioral task
behavioral1
Sample
ebacaba15518ab84674beaef6fbb88fb978d3954394e47abc947202e3ec2abe4.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
danko
185.161.248.73:4164
-
auth_value
784d42a6c1eb1a5060b8bcd3696f5f1e
Targets
-
-
Target
ebacaba15518ab84674beaef6fbb88fb978d3954394e47abc947202e3ec2abe4
-
Size
850KB
-
MD5
059b328d369e1c3d9b0034a92076c723
-
SHA1
ebdb66121654329d3c8785916bd481289fe9177b
-
SHA256
ebacaba15518ab84674beaef6fbb88fb978d3954394e47abc947202e3ec2abe4
-
SHA512
230c60c69857a1a4051d6d32c8629f1871a1ab624d2158ffd45383fcf601642b7c518b8d657d7f36eca2de96dbf5094d15f3be4265fdf355480c8edf093b625c
-
SSDEEP
24576:Tyaq8Rr8e6EE8Ch3W0ziCXEFP48QeFwkGPSakrpvq7:mQr8e9pgqCULTFh8Sakrpvq
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-