General
-
Target
b1ac8e48a00e681fcb34450557a6d29fe3965a57bdde4167a90bc4024d947f70N.exe
-
Size
574KB
-
Sample
241113-q7hwpasmgx
-
MD5
2e775e064c6678443d0707c0e67cf480
-
SHA1
b6b24f08f781ca404d054c0867e8db1b74de8b4f
-
SHA256
b1ac8e48a00e681fcb34450557a6d29fe3965a57bdde4167a90bc4024d947f70
-
SHA512
d16d562a3312f3c8671b04d2e4580c795e20faa56fc941c2b47978f9bb6d124d1b4d24e4e8dc810d971d2aa793263513c2b6fe040433243fe3320d8668b1a84a
-
SSDEEP
12288:plvTqsKami8mOB+C+uiDum8SPl/O+50NzXTKbx7SK:plbqbi8d+P1KjSN/z50dDKbx7L
Static task
static1
Behavioral task
behavioral1
Sample
b1ac8e48a00e681fcb34450557a6d29fe3965a57bdde4167a90bc4024d947f70N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b1ac8e48a00e681fcb34450557a6d29fe3965a57bdde4167a90bc4024d947f70N.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Targets
-
-
Target
b1ac8e48a00e681fcb34450557a6d29fe3965a57bdde4167a90bc4024d947f70N.exe
-
Size
574KB
-
MD5
2e775e064c6678443d0707c0e67cf480
-
SHA1
b6b24f08f781ca404d054c0867e8db1b74de8b4f
-
SHA256
b1ac8e48a00e681fcb34450557a6d29fe3965a57bdde4167a90bc4024d947f70
-
SHA512
d16d562a3312f3c8671b04d2e4580c795e20faa56fc941c2b47978f9bb6d124d1b4d24e4e8dc810d971d2aa793263513c2b6fe040433243fe3320d8668b1a84a
-
SSDEEP
12288:plvTqsKami8mOB+C+uiDum8SPl/O+50NzXTKbx7SK:plbqbi8d+P1KjSN/z50dDKbx7L
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-