General
-
Target
edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe
-
Size
1.5MB
-
Sample
240701-qxy5xsyalk
-
MD5
aa9d475bc02429a35578c7c7495391c0
-
SHA1
aefabfe061db6b6013e842c1ff5afb09b5686a6a
-
SHA256
edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91
-
SHA512
3b058dee4b5a959b64e1ade4206f87a4ec46594b58a270866920318593d98c9025b15d17c3486f1595955238cedde86f1b2a8ebb722cc1668c315a9fcd31560a
-
SSDEEP
24576:iUwjiv9SI194bspApcCmILYKV+u9O4qZFIYJnddR+Xk85PPU5cgyXd8UOybz:ROivgHcCmIf+u9YZrpk9BRdhbz
Static task
static1
Behavioral task
behavioral1
Sample
edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
redline
185.196.9.26:6302
Targets
-
-
Target
edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91.exe
-
Size
1.5MB
-
MD5
aa9d475bc02429a35578c7c7495391c0
-
SHA1
aefabfe061db6b6013e842c1ff5afb09b5686a6a
-
SHA256
edc0a83088582cf9cc1ed9d7414d387af4c626482d991585e028facc8da51e91
-
SHA512
3b058dee4b5a959b64e1ade4206f87a4ec46594b58a270866920318593d98c9025b15d17c3486f1595955238cedde86f1b2a8ebb722cc1668c315a9fcd31560a
-
SSDEEP
24576:iUwjiv9SI194bspApcCmILYKV+u9O4qZFIYJnddR+Xk85PPU5cgyXd8UOybz:ROivgHcCmIf+u9YZrpk9BRdhbz
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-