General
-
Target
fff4bcd716b7548669070982a5b03964.exe
-
Size
360KB
-
Sample
210608-9x9ayqckjs
-
MD5
fff4bcd716b7548669070982a5b03964
-
SHA1
deb87197e1cec0548018f73469ba1544faf1afd3
-
SHA256
e228070565b955ec46508c0115d70d07299a5db66ddca69b798bee43ee7aa603
-
SHA512
d668197ad05661aeb27cf1a7e92ee226c5db200b492b697f6f4ca023649b394fbb7f598938a8bf8dc9ae01644970c92f96ebc6b86602db53ee3d02916c98dd64
Static task
static1
Behavioral task
behavioral1
Sample
fff4bcd716b7548669070982a5b03964.exe
Resource
win7v20210408
Malware Config
Extracted
redline
Kolya
195.201.17.219:25524
Targets
-
-
Target
fff4bcd716b7548669070982a5b03964.exe
-
Size
360KB
-
MD5
fff4bcd716b7548669070982a5b03964
-
SHA1
deb87197e1cec0548018f73469ba1544faf1afd3
-
SHA256
e228070565b955ec46508c0115d70d07299a5db66ddca69b798bee43ee7aa603
-
SHA512
d668197ad05661aeb27cf1a7e92ee226c5db200b492b697f6f4ca023649b394fbb7f598938a8bf8dc9ae01644970c92f96ebc6b86602db53ee3d02916c98dd64
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-