General
- Target a35518b5be67fad36ce6037f2c79d85fa1f9deab01aac.exe
- Size 100KB
- Sample210817-j9nf17bbl2
- SHA256 a35518b5be67fad36ce6037f2c79d85fa1f9deab01aac9e34c21fde5f2b13eb8
- MD5 325dd7c825006968846e9cd8e5d3ddbe
- SHA1 cb5aa59c64b22a3fb33d83fc3086b0d2b5ceb0ce
- SHA512 cf9569d70b657d6c9e662a838e12413e771cc0ae3d8505399f8d99b5c10223da2b19da9247f1827a11b273e942a7db7d480f0b0586f5db20ec94311978c11a06
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
a35518b5be67fad36ce6037f2c79d85fa1f9deab01aac.exe
Resource
win7v20210410
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a35518b5be67fad36ce6037f2c79d85fa1f9deab01aac.exe
Resource
win10v20210408
0 signatures
0 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
ww
C2
-
159.69.178.36:37556
Targets
-
- Target a35518b5be67fad36ce6037f2c79d85fa1f9deab01aac.exe
- Size 100KB
- SHA256 a35518b5be67fad36ce6037f2c79d85fa1f9deab01aac9e34c21fde5f2b13eb8
- MD5 325dd7c825006968846e9cd8e5d3ddbe
- SHA1 cb5aa59c64b22a3fb33d83fc3086b0d2b5ceb0ce
- SHA512 cf9569d70b657d6c9e662a838e12413e771cc0ae3d8505399f8d99b5c10223da2b19da9247f1827a11b273e942a7db7d480f0b0586f5db20ec94311978c11a06
- MD5 SHA1 SHA512
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.