General
-
Target
d0efcc1118ed873a8be9d43aae5aca8afa3238244bf559d23972cd85bf01f354
-
Size
565KB
-
Sample
210914-2pebbsbdel
-
MD5
2d789a9e6b0b5aec610520055bd8c048
-
SHA1
b9f9aa51c4fc845c81c06a9f883dd6cfc60df550
-
SHA256
d0efcc1118ed873a8be9d43aae5aca8afa3238244bf559d23972cd85bf01f354
-
SHA512
727b8c41d1ea43b484a5fdcc66aad3048f49ce10ee80544c67a08498b6f03f5127639e8da42357e8fa8c07a40a7c985ee5c11509da6b82b72947d3b96c58710a
Static task
static1
Malware Config
Extracted
redline
mix15.09
185.215.113.15:6043
Targets
-
-
Target
d0efcc1118ed873a8be9d43aae5aca8afa3238244bf559d23972cd85bf01f354
-
Size
565KB
-
MD5
2d789a9e6b0b5aec610520055bd8c048
-
SHA1
b9f9aa51c4fc845c81c06a9f883dd6cfc60df550
-
SHA256
d0efcc1118ed873a8be9d43aae5aca8afa3238244bf559d23972cd85bf01f354
-
SHA512
727b8c41d1ea43b484a5fdcc66aad3048f49ce10ee80544c67a08498b6f03f5127639e8da42357e8fa8c07a40a7c985ee5c11509da6b82b72947d3b96c58710a
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-