General
-
Target
d0f6917a1c6b084019a30c0dfd1d7d55bfd588c9bec8cdf805a7302812bf2d31
-
Size
284KB
-
Sample
211126-n2aa9acbbp
-
MD5
eb1c0bf4d151ca862ea5e422675b901a
-
SHA1
55ec8a67e0870c4eab12baa82295a83b821d73e8
-
SHA256
d0f6917a1c6b084019a30c0dfd1d7d55bfd588c9bec8cdf805a7302812bf2d31
-
SHA512
b6943f7990eec84094bfc5d7f5dbc2e3dff21f0382467ff7f77e0ff9c1acd9aedd3bde844482668c22a8e1a2dc6855ad3ddcdc39479ff3c745d12bd20984b600
Static task
static1
Malware Config
Extracted
redline
udptest
193.56.146.64:65441
Targets
-
-
Target
d0f6917a1c6b084019a30c0dfd1d7d55bfd588c9bec8cdf805a7302812bf2d31
-
Size
284KB
-
MD5
eb1c0bf4d151ca862ea5e422675b901a
-
SHA1
55ec8a67e0870c4eab12baa82295a83b821d73e8
-
SHA256
d0f6917a1c6b084019a30c0dfd1d7d55bfd588c9bec8cdf805a7302812bf2d31
-
SHA512
b6943f7990eec84094bfc5d7f5dbc2e3dff21f0382467ff7f77e0ff9c1acd9aedd3bde844482668c22a8e1a2dc6855ad3ddcdc39479ff3c745d12bd20984b600
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-