General
- Target 0547e698f43ca812e53e401c23b2797d4043aebbeceaf.exe
- Size 508KB
- Sample211028-nkejmsbec4
- SHA256 0547e698f43ca812e53e401c23b2797d4043aebbeceafe07bfab831672758d0f
- MD5 20702d17835107e845585f67d327dbfc
- SHA1 186446695823032f2344e7024d67fd644d461f95
- SHA512 3b610988f752a8411727be89a236a778376074acc67ab60ae8700af4d8a3cf3cd9c4359cd07ee541e7819a5e86c0f7e35b7383dfc8181ce297507859e6676def
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
0547e698f43ca812e53e401c23b2797d4043aebbeceaf.exe
Resource
win7-en-20210920
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0547e698f43ca812e53e401c23b2797d4043aebbeceaf.exe
Resource
win10-en-20211014
0 signatures
0 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
1.000.000 2007 MONETA NE BREND + PASS
C2
-
185.215.113.49:29659
Targets
-
- Target 0547e698f43ca812e53e401c23b2797d4043aebbeceaf.exe
- Size 508KB
- SHA256 0547e698f43ca812e53e401c23b2797d4043aebbeceafe07bfab831672758d0f
- MD5 20702d17835107e845585f67d327dbfc
- SHA1 186446695823032f2344e7024d67fd644d461f95
- SHA512 3b610988f752a8411727be89a236a778376074acc67ab60ae8700af4d8a3cf3cd9c4359cd07ee541e7819a5e86c0f7e35b7383dfc8181ce297507859e6676def
- MD5 SHA1 SHA512
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.