General
-
Target
59786cf4ed9f5abd0a5b8fa810764e66f6f958f95452a9908f582a37fe1a4ff3
-
Size
178KB
-
Sample
220321-s7gpqsdef6
-
MD5
cb37b2c03cca2f4ae68d7e2b7f8e8493
-
SHA1
ca21f84498ddf02eef6ebbbb6f9c7f1f64d97cc2
-
SHA256
59786cf4ed9f5abd0a5b8fa810764e66f6f958f95452a9908f582a37fe1a4ff3
-
SHA512
9601bb4dba108a963edc802569928e7c519f7bb22985b328577ea85eea5a31b423deb55344a1863302624c2649c0c79006a0f41e107407f802aa27beaa26942b
Malware Config
Extracted
redline
2
45.72.110.144:8890
-
auth_value
666a53b9a643121a4307a6a283389db6
Targets
-
-
Target
59786cf4ed9f5abd0a5b8fa810764e66f6f958f95452a9908f582a37fe1a4ff3
-
Size
178KB
-
MD5
cb37b2c03cca2f4ae68d7e2b7f8e8493
-
SHA1
ca21f84498ddf02eef6ebbbb6f9c7f1f64d97cc2
-
SHA256
59786cf4ed9f5abd0a5b8fa810764e66f6f958f95452a9908f582a37fe1a4ff3
-
SHA512
9601bb4dba108a963edc802569928e7c519f7bb22985b328577ea85eea5a31b423deb55344a1863302624c2649c0c79006a0f41e107407f802aa27beaa26942b
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-