General
-
Target
4643498111804354a0f93ac75944ea9e26b3809eb00183518f60de80c1f1054a
-
Size
449KB
-
Sample
211021-pz6gcabber
-
MD5
ef55f7b6fd454379494cedc842bc0750
-
SHA1
cc1d6ce00149cb979425b897877f8cb78d193f1f
-
SHA256
4643498111804354a0f93ac75944ea9e26b3809eb00183518f60de80c1f1054a
-
SHA512
1361aeaa8d7f33b1372d07ea239ab442a657830b4d303c002964d2c2cc0fb029b43910974f25ad9f745f0dbf87a7cbfc427b096dd44989283f8ce36f4b864351
Static task
static1
Malware Config
Targets
-
-
Target
4643498111804354a0f93ac75944ea9e26b3809eb00183518f60de80c1f1054a
-
Size
449KB
-
MD5
ef55f7b6fd454379494cedc842bc0750
-
SHA1
cc1d6ce00149cb979425b897877f8cb78d193f1f
-
SHA256
4643498111804354a0f93ac75944ea9e26b3809eb00183518f60de80c1f1054a
-
SHA512
1361aeaa8d7f33b1372d07ea239ab442a657830b4d303c002964d2c2cc0fb029b43910974f25ad9f745f0dbf87a7cbfc427b096dd44989283f8ce36f4b864351
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-