General
-
Target
2c45d21de9caa436bc296e99df8a8409c0aea3126e3f125abafb036a4124c642
-
Size
565KB
-
Sample
210915-cf43ysbeeq
-
MD5
fe4a7ad6dbe0a0ae9c148de33f50802b
-
SHA1
b0b959e0bd284bd45eb7492d51b3e189ec5dd402
-
SHA256
2c45d21de9caa436bc296e99df8a8409c0aea3126e3f125abafb036a4124c642
-
SHA512
c6b1ec7cb76ad77a1f0be4e5b3c692a8981a7116f68b81d1d0c3bba9130ffe26aca8d1aa09b14868910cbd0a61ce853f8aeb77743f54f23427d6c85b1c4c7b64
Static task
static1
Malware Config
Extracted
redline
15.09
185.215.113.17:48236
Targets
-
-
Target
2c45d21de9caa436bc296e99df8a8409c0aea3126e3f125abafb036a4124c642
-
Size
565KB
-
MD5
fe4a7ad6dbe0a0ae9c148de33f50802b
-
SHA1
b0b959e0bd284bd45eb7492d51b3e189ec5dd402
-
SHA256
2c45d21de9caa436bc296e99df8a8409c0aea3126e3f125abafb036a4124c642
-
SHA512
c6b1ec7cb76ad77a1f0be4e5b3c692a8981a7116f68b81d1d0c3bba9130ffe26aca8d1aa09b14868910cbd0a61ce853f8aeb77743f54f23427d6c85b1c4c7b64
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-