General
-
Target
7c43f9321e43eaf3edff6ddc34fe3038.exe
-
Size
755KB
-
Sample
210611-bld4rnyd9s
-
MD5
7c43f9321e43eaf3edff6ddc34fe3038
-
SHA1
4a31366cb0ae0f67aaef3cc38c328d4ccc8b3dad
-
SHA256
f81b0ee364ffb419c8af7bdaf03670bb7fa7dec30aa1d6f486e7a8157768eed2
-
SHA512
e428ed5f93248f3385e65664bd2a9c2921b137d1c711bc467151ee92607bf82452d996f123984281c9e9db9a4d3bbd1493ea4757401cbc272490f471c1504200
Static task
static1
Behavioral task
behavioral1
Sample
7c43f9321e43eaf3edff6ddc34fe3038.exe
Resource
win7v20210410
Malware Config
Extracted
redline
MIX 11.06
185.215.113.17:18597
Targets
-
-
Target
7c43f9321e43eaf3edff6ddc34fe3038.exe
-
Size
755KB
-
MD5
7c43f9321e43eaf3edff6ddc34fe3038
-
SHA1
4a31366cb0ae0f67aaef3cc38c328d4ccc8b3dad
-
SHA256
f81b0ee364ffb419c8af7bdaf03670bb7fa7dec30aa1d6f486e7a8157768eed2
-
SHA512
e428ed5f93248f3385e65664bd2a9c2921b137d1c711bc467151ee92607bf82452d996f123984281c9e9db9a4d3bbd1493ea4757401cbc272490f471c1504200
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-