General
-
Target
9232bf1ec26523d3e32ff35c2960f6f69b2ed3e8b450c7968f138c74b046004e
-
Size
669KB
-
Sample
210831-txzjcd3aln
-
MD5
7b94e8f96bfd681e6d8d7ebc9e426494
-
SHA1
7b05fb596b170038a30406a3b89cebead1f0e75f
-
SHA256
9232bf1ec26523d3e32ff35c2960f6f69b2ed3e8b450c7968f138c74b046004e
-
SHA512
631fad75fe13ccf5218e85b781f829e6b5181746ad7977093d5fb42e7ff9af0c46604efd716c199f74d55cd7bab43491541c189ceb11a076a1e5c1049c0b5223
Static task
static1
Malware Config
Extracted
redline
mix31.08
185.215.113.15:6043
Targets
-
-
Target
9232bf1ec26523d3e32ff35c2960f6f69b2ed3e8b450c7968f138c74b046004e
-
Size
669KB
-
MD5
7b94e8f96bfd681e6d8d7ebc9e426494
-
SHA1
7b05fb596b170038a30406a3b89cebead1f0e75f
-
SHA256
9232bf1ec26523d3e32ff35c2960f6f69b2ed3e8b450c7968f138c74b046004e
-
SHA512
631fad75fe13ccf5218e85b781f829e6b5181746ad7977093d5fb42e7ff9af0c46604efd716c199f74d55cd7bab43491541c189ceb11a076a1e5c1049c0b5223
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-