General
-
Target
2edbc4c07f9511953655e08e927fa55be316da854b214a724506667f748254cb
-
Size
239KB
-
Sample
210926-3wh4jafdf9
-
MD5
6389943a14faacd7bf091f3f608cfa52
-
SHA1
3eb04f688b413af8cd5d45bc57a9e4da35bf5f70
-
SHA256
2edbc4c07f9511953655e08e927fa55be316da854b214a724506667f748254cb
-
SHA512
964ba69f5631ba04db042d24be469e099e0a18ee68432bbaee7a3f342712c71ebc3a06651b16efbdbef04118a1c60abfe4b2c7780a6ac4b11dd4d1ba5a8780e7
Static task
static1
Malware Config
Extracted
redline
UDP
45.9.20.20:13441
Targets
-
-
Target
2edbc4c07f9511953655e08e927fa55be316da854b214a724506667f748254cb
-
Size
239KB
-
MD5
6389943a14faacd7bf091f3f608cfa52
-
SHA1
3eb04f688b413af8cd5d45bc57a9e4da35bf5f70
-
SHA256
2edbc4c07f9511953655e08e927fa55be316da854b214a724506667f748254cb
-
SHA512
964ba69f5631ba04db042d24be469e099e0a18ee68432bbaee7a3f342712c71ebc3a06651b16efbdbef04118a1c60abfe4b2c7780a6ac4b11dd4d1ba5a8780e7
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-