General
- Target 1f2e545cf5b749b5ee400f46b52832d416d63c6a32b7b.exe
- Size 260KB
- Sample210926-baytbaebb9
- SHA256 1f2e545cf5b749b5ee400f46b52832d416d63c6a32b7b29dee3b954b35abf39e
- MD5 5864c36c9129430f27f0318ed50941e2
- SHA1 052544bbf2838550a16d06c67f1b506be8b74dd1
- SHA512 39730ee6abf5ccc57807fd7b0d523abf9b87c28740bbafe0c63c42d9269746db856fbe9cbe49d5337d578dc71248a1bbb6bb10b8ab7fe00bee57845846d2b146
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
1f2e545cf5b749b5ee400f46b52832d416d63c6a32b7b.exe
Resource
win7-en-20210920
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1f2e545cf5b749b5ee400f46b52832d416d63c6a32b7b.exe
Resource
win10v20210408
0 signatures
0 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
buildfortest333
C2
-
185.173.37.128:40504
Targets
-
- Target 1f2e545cf5b749b5ee400f46b52832d416d63c6a32b7b.exe
- Size 260KB
- SHA256 1f2e545cf5b749b5ee400f46b52832d416d63c6a32b7b29dee3b954b35abf39e
- MD5 5864c36c9129430f27f0318ed50941e2
- SHA1 052544bbf2838550a16d06c67f1b506be8b74dd1
- SHA512 39730ee6abf5ccc57807fd7b0d523abf9b87c28740bbafe0c63c42d9269746db856fbe9cbe49d5337d578dc71248a1bbb6bb10b8ab7fe00bee57845846d2b146
- MD5 SHA1 SHA512
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.