General
-
Target
cc5e1aaf33fc18e2c7a1810b8c9eca7a8a74361a7d1bd59f9674c8d309c315a5
-
Size
498KB
-
Sample
240628-c7472azcmp
-
MD5
32e27413bc3a794a29c5ac4bc0221f56
-
SHA1
abdbf16720eac699508a83152431e781a99da490
-
SHA256
cc5e1aaf33fc18e2c7a1810b8c9eca7a8a74361a7d1bd59f9674c8d309c315a5
-
SHA512
155ed501dcaf138921131bd193a019207166c1b6f3028562adad1b7cca7b28a37db9fefdce643a648d96577b97ea5980f1f4e48355b5cf50c57d1cc08d209fb4
-
SSDEEP
12288:3piYNtu2KrpqlaWcysWkbDNg7TS1BC38zOf6vpA022eBcc/gGLrZvx+U52CAFNWD:3rNY2CpkaWcysWkbDi3SWsK6v20NeBce
Static task
static1
Behavioral task
behavioral1
Sample
cc5e1aaf33fc18e2c7a1810b8c9eca7a8a74361a7d1bd59f9674c8d309c315a5.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
cc5e1aaf33fc18e2c7a1810b8c9eca7a8a74361a7d1bd59f9674c8d309c315a5.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
redline
@nmrzv88
94.228.166.68:80
Targets
-
-
Target
cc5e1aaf33fc18e2c7a1810b8c9eca7a8a74361a7d1bd59f9674c8d309c315a5
-
Size
498KB
-
MD5
32e27413bc3a794a29c5ac4bc0221f56
-
SHA1
abdbf16720eac699508a83152431e781a99da490
-
SHA256
cc5e1aaf33fc18e2c7a1810b8c9eca7a8a74361a7d1bd59f9674c8d309c315a5
-
SHA512
155ed501dcaf138921131bd193a019207166c1b6f3028562adad1b7cca7b28a37db9fefdce643a648d96577b97ea5980f1f4e48355b5cf50c57d1cc08d209fb4
-
SSDEEP
12288:3piYNtu2KrpqlaWcysWkbDNg7TS1BC38zOf6vpA022eBcc/gGLrZvx+U52CAFNWD:3rNY2CpkaWcysWkbDi3SWsK6v20NeBce
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Suspicious use of SetThreadContext
-