General
-
Target
75d4b2f64dde3fc89adf5c39891111af.exe
-
Size
913KB
-
Sample
240629-j29c5ateqf
-
MD5
75d4b2f64dde3fc89adf5c39891111af
-
SHA1
cad9e02a08dda87d0e2b88ac3c96ce1b1de5740e
-
SHA256
a23d1f07dfef6b5fda6381ecf6866746d624dbc1e510073d83f431124bf7d556
-
SHA512
462f1de721d5005b0d89168f7b5b1937b7b16f0edf99430104a60505b33a65eaf02f03b36b839e1b5633bc45eaf9f03bd5ccff121e7302f431d263a99d586203
-
SSDEEP
24576:v4TiFiWXYwSv6ZNuzcB3mNO0Uoq0NDQDd:v4gbM0+k8p60Kd
Static task
static1
Behavioral task
behavioral1
Sample
75d4b2f64dde3fc89adf5c39891111af.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
75d4b2f64dde3fc89adf5c39891111af.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
redline
foz
147.45.45.3:1912
Targets
-
-
Target
75d4b2f64dde3fc89adf5c39891111af.exe
-
Size
913KB
-
MD5
75d4b2f64dde3fc89adf5c39891111af
-
SHA1
cad9e02a08dda87d0e2b88ac3c96ce1b1de5740e
-
SHA256
a23d1f07dfef6b5fda6381ecf6866746d624dbc1e510073d83f431124bf7d556
-
SHA512
462f1de721d5005b0d89168f7b5b1937b7b16f0edf99430104a60505b33a65eaf02f03b36b839e1b5633bc45eaf9f03bd5ccff121e7302f431d263a99d586203
-
SSDEEP
24576:v4TiFiWXYwSv6ZNuzcB3mNO0Uoq0NDQDd:v4gbM0+k8p60Kd
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-