General
-
Target
cf474d186c9d81aa7d9ba7837754cca0.exe
-
Size
100KB
-
Sample
210803-fxhz7p5z9s
-
MD5
cf474d186c9d81aa7d9ba7837754cca0
-
SHA1
caa5640f4085238c0c84a191a38d85aaaa6e42fe
-
SHA256
3cc3678682dc887a9f5e168717967fc266e266a5fd5dfe10e210d26b7246e5c4
-
SHA512
c2e1dba69d89ca28ac5306d57922f2ac2e90cdb0b15846bc963a472b9bf87874c0fb9ec5435091ad59fe4b6d7deec6719369bea12af3267011fcd02f0948f960
Behavioral task
behavioral1
Sample
cf474d186c9d81aa7d9ba7837754cca0.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
cf474d186c9d81aa7d9ba7837754cca0.exe
Resource
win10v20210408
Malware Config
Extracted
redline
@mecenaty
51.254.69.209:48987
Targets
-
-
Target
cf474d186c9d81aa7d9ba7837754cca0.exe
-
Size
100KB
-
MD5
cf474d186c9d81aa7d9ba7837754cca0
-
SHA1
caa5640f4085238c0c84a191a38d85aaaa6e42fe
-
SHA256
3cc3678682dc887a9f5e168717967fc266e266a5fd5dfe10e210d26b7246e5c4
-
SHA512
c2e1dba69d89ca28ac5306d57922f2ac2e90cdb0b15846bc963a472b9bf87874c0fb9ec5435091ad59fe4b6d7deec6719369bea12af3267011fcd02f0948f960
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-