General
-
Target
9ea4469f78d2953c8061672f6c7630a9728b42944e37be3e30bc6774812af88a
-
Size
622KB
-
Sample
210902-s6mvcsafc9
-
MD5
c401e59268ce122cbe861437d99de240
-
SHA1
b73d04412ab3dc1b7ac6c11d8343ab29831a8b32
-
SHA256
9ea4469f78d2953c8061672f6c7630a9728b42944e37be3e30bc6774812af88a
-
SHA512
707e7f15af8b8bd9c99e70cd126c5fb5577ab1ceb8c45c23f5842fe666ca774e2966f77cf7eeaa30bd322d235bf004466a33909cd5ee8617f3c9e076b57fcb4f
Static task
static1
Malware Config
Extracted
redline
test1
54.38.136.110:27734
Targets
-
-
Target
9ea4469f78d2953c8061672f6c7630a9728b42944e37be3e30bc6774812af88a
-
Size
622KB
-
MD5
c401e59268ce122cbe861437d99de240
-
SHA1
b73d04412ab3dc1b7ac6c11d8343ab29831a8b32
-
SHA256
9ea4469f78d2953c8061672f6c7630a9728b42944e37be3e30bc6774812af88a
-
SHA512
707e7f15af8b8bd9c99e70cd126c5fb5577ab1ceb8c45c23f5842fe666ca774e2966f77cf7eeaa30bd322d235bf004466a33909cd5ee8617f3c9e076b57fcb4f
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-