General
-
Target
c195b09d0b55e008f7914bec8bd81ae1f568a94955ed4e798aefc24f8df41d3e
-
Size
390KB
-
Sample
211016-dh9xnacear
-
MD5
b3005748f41f9bbc4ce8f132e07464f8
-
SHA1
4953ffb2e1e82e09748dabffe363846e598727b1
-
SHA256
c195b09d0b55e008f7914bec8bd81ae1f568a94955ed4e798aefc24f8df41d3e
-
SHA512
66d9a5420cef0b89051086a1da413fbbda5e92939a22495c296190ba3bd75b58f5907d6be171e4b7d031ea36ac7b32ba5217410cbac809e2f239eff4b80a5288
Static task
static1
Malware Config
Extracted
redline
paladin
37.228.129.48:29795
Targets
-
-
Target
c195b09d0b55e008f7914bec8bd81ae1f568a94955ed4e798aefc24f8df41d3e
-
Size
390KB
-
MD5
b3005748f41f9bbc4ce8f132e07464f8
-
SHA1
4953ffb2e1e82e09748dabffe363846e598727b1
-
SHA256
c195b09d0b55e008f7914bec8bd81ae1f568a94955ed4e798aefc24f8df41d3e
-
SHA512
66d9a5420cef0b89051086a1da413fbbda5e92939a22495c296190ba3bd75b58f5907d6be171e4b7d031ea36ac7b32ba5217410cbac809e2f239eff4b80a5288
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-