Overview
overview
10Static
static
3R B X 9 5.rar
windows7-x64
3R B X 9 5.rar
windows10-2004-x64
3R B X 9 5/Client.exe
windows7-x64
1R B X 9 5/Client.exe
windows10-2004-x64
1R B X 9 5/...or.exe
windows7-x64
7R B X 9 5/...or.exe
windows10-2004-x64
10R B X 9 5/ai.cfg
windows7-x64
3R B X 9 5/ai.cfg
windows10-2004-x64
3R B X 9 5/cacert.pem
windows7-x64
3R B X 9 5/cacert.pem
windows10-2004-x64
3R B X 9 5/config.vdf
windows7-x64
3R B X 9 5/config.vdf
windows10-2004-x64
3General
-
Target
R B X 9 5.rar
-
Size
9.6MB
-
Sample
240630-jf3cpavdpc
-
MD5
dd7a3dd6705772279e7b04a4b3fd65a2
-
SHA1
972e75b89f5960c05f08c19403299600b1f99ea5
-
SHA256
6be4d25bd90b841fd9693a567f1983de0d1c4155a62ee066cf5f1837e75c1b06
-
SHA512
bf995bcd03cd05ae9f68e83d98f80cedff2c561eedce1accf4e037374d7238bd4feafa105fbddc38ac0a6c813d279ecc952c8d08f648ff3b09e4776050a35368
-
SSDEEP
196608:oygvM5WtHmTsHsS9TpcJyjjwsnxrjUd79TRlIL0GV:o7MgH4sHf9TpcQwsnxcd7vlIvV
Static task
static1
Behavioral task
behavioral1
Sample
R B X 9 5.rar
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
R B X 9 5.rar
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
R B X 9 5/Client.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
R B X 9 5/Client.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
R B X 9 5/Roblox Executor.exe
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
R B X 9 5/Roblox Executor.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
R B X 9 5/ai.cfg
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
R B X 9 5/ai.cfg
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
R B X 9 5/cacert.pem
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
R B X 9 5/cacert.pem
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
R B X 9 5/config.vdf
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
R B X 9 5/config.vdf
Resource
win10v2004-20240611-en
Malware Config
Extracted
redline
185.196.9.26:6302
Targets
-
-
Target
R B X 9 5.rar
-
Size
9.6MB
-
MD5
dd7a3dd6705772279e7b04a4b3fd65a2
-
SHA1
972e75b89f5960c05f08c19403299600b1f99ea5
-
SHA256
6be4d25bd90b841fd9693a567f1983de0d1c4155a62ee066cf5f1837e75c1b06
-
SHA512
bf995bcd03cd05ae9f68e83d98f80cedff2c561eedce1accf4e037374d7238bd4feafa105fbddc38ac0a6c813d279ecc952c8d08f648ff3b09e4776050a35368
-
SSDEEP
196608:oygvM5WtHmTsHsS9TpcJyjjwsnxrjUd79TRlIL0GV:o7MgH4sHf9TpcQwsnxcd7vlIvV
Score3/10 -
-
-
Target
R B X 9 5/Client.config
-
Size
33.0MB
-
MD5
157bca5bfbab154797fbbe947946084f
-
SHA1
280096391abd2ea592198d205b6e44cdd2408121
-
SHA256
f9aae2ca83d60ae3a6e443d23c91672cda766f73003e4f3f0f99eec1f336d946
-
SHA512
5fbbaa59d4425779ecae554372a476414a60b70fe190ca408a0505b13064866d1576e6409e657d2933cd5922a053aacdf7c01b457b3385476dabfe1c46b5c1da
-
SSDEEP
786432:BeCve2OlHAoFfgrh96BKMZvBx9ImCrWFi6:BejjlHAopI9xABx9ErWFi6
Score1/10 -
-
-
Target
R B X 9 5/Roblox Executor.exe
-
Size
359KB
-
MD5
e3106b33d419c2b1d7920d8f55e0b5c8
-
SHA1
3bfc3ec1727477c0df43644268d4c9ebdea00662
-
SHA256
cea6948d7fcd91a07f883c0216bbf0c8a71bbbd860b8752d965ff4421d2ec01f
-
SHA512
01113183c50a1eab161b5117b96a856ce457c3a30f9dcad949cd4e9020e72409be2a4e56fce7f523bd648daa1aed06e2a1f1c3ae0f3bfb6b0520e979986a9f50
-
SSDEEP
6144:afP6YNEL+sAO6gaZKKfL2GKfaVeV+mTlEIwrjef7UBgHvMW7xJpg1vLfIGfXP:af10AYaZZDi7VTlfwrjef7UBgHvMW7xi
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-
-
-
Target
R B X 9 5/ai.cfg
-
Size
44B
-
MD5
73ed0e22c8cc70ed93dfd0c1b8f81e19
-
SHA1
f16c87ca3eb393ee34f57fb59781cd37f5963db0
-
SHA256
db9ec7ae21d140904d44d6e6550c0c964e32ef11c055696b355835905c9c3a53
-
SHA512
3dbe1fd660c7446c4a70c99cf6bf7909c76cd02ca24930bdeee851da094850b2fd6f6742025d215ce7dbf3348225c0b64d28e3f1ba133bdd9c7beece84d7e54f
Score3/10 -
-
-
Target
R B X 9 5/cacert.pem
-
Size
2KB
-
MD5
39f89143815797c4a41c62f30f137094
-
SHA1
39a602c37ee958e5a5779c167ea095a56f0218e4
-
SHA256
5513aa54afe134569e08b27aa61e60e888ab31d9e112f8c5881adbaecc817678
-
SHA512
02cfee4a3fdc728e63e5a63797c58c5a6fbd805f6f6e5c0ab4e5dbf1d1701636a6aefc94095096b627b7475e731327d620c519ddc1a65b3ee49dd41b4d219d6d
Score3/10 -
-
-
Target
R B X 9 5/config.vdf
-
Size
14KB
-
MD5
bb23e26ed15c9951460513efdb0b7ac7
-
SHA1
41e15b1f30840160ea095f0f415ac3afd6d06968
-
SHA256
9fce8b4ac41455418615f2785199f72d7fe6ce39d8cd9182027a752c4f26d04a
-
SHA512
f3f3e7ef4765520554fcb523b43f448b28b29fbbf150657728084b720fca4568a23a3846f37f3c57b6710fdeb3761fecc190f468944ba1a687aad0e8f7af1093
-
SSDEEP
96:o9lCt/5KFdRBQ20LPr7U8Op3y47Zu/ZqaJOTFogkU:o9MtBKFdRBQ20LPr7U8OBlsRq8gkU
Score3/10 -