General
-
Target
cd217b0e6e936f9ae9492ec1a089cdcf.exe
-
Size
400KB
-
Sample
211128-zd5m2aafam
-
MD5
cd217b0e6e936f9ae9492ec1a089cdcf
-
SHA1
14ac87815ea815f8997f0a4c751cc352822a7975
-
SHA256
5f5eacd77526de995a9caaaa7a963d18c5f7732b22fad8a0151ac8c25c9baad8
-
SHA512
fbf065be9b4cc648493e4829473902c7c68971a3b59be7908ad5699de69bd9283deab1487d1af05bf2110f4d2468992db6e5af02f26517b8ab376040702e0c73
Static task
static1
Behavioral task
behavioral1
Sample
cd217b0e6e936f9ae9492ec1a089cdcf.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
cd217b0e6e936f9ae9492ec1a089cdcf.exe
Resource
win10-en-20211104
Malware Config
Extracted
redline
BADMAN2020
147.124.208.247:34932
Targets
-
-
Target
cd217b0e6e936f9ae9492ec1a089cdcf.exe
-
Size
400KB
-
MD5
cd217b0e6e936f9ae9492ec1a089cdcf
-
SHA1
14ac87815ea815f8997f0a4c751cc352822a7975
-
SHA256
5f5eacd77526de995a9caaaa7a963d18c5f7732b22fad8a0151ac8c25c9baad8
-
SHA512
fbf065be9b4cc648493e4829473902c7c68971a3b59be7908ad5699de69bd9283deab1487d1af05bf2110f4d2468992db6e5af02f26517b8ab376040702e0c73
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-