General
-
Target
tmp
-
Size
367KB
-
Sample
220414-ya6v9adfdm
-
MD5
4755cfd6208be61c17281a0d15327d12
-
SHA1
6f6911fad162e14a62d692c834092560bb84c4d8
-
SHA256
19d07238694abc8194eb3320811df802f41ccea163b856e2f0f4930ef4225f2e
-
SHA512
a2a0e55a28876ee6e10b3ed324125fb1c02393568e3620117b90f5887f10cc839d717e902a9a637aac59e70a4da67810d690246b33d9ed09f6f38b8aedd2a0be
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220331-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
redline
BTC
iludacorsl.xyz:80
-
auth_value
7b5077dd0fc9bf4645e30b9a396f9d7f
Targets
-
-
Target
tmp
-
Size
367KB
-
MD5
4755cfd6208be61c17281a0d15327d12
-
SHA1
6f6911fad162e14a62d692c834092560bb84c4d8
-
SHA256
19d07238694abc8194eb3320811df802f41ccea163b856e2f0f4930ef4225f2e
-
SHA512
a2a0e55a28876ee6e10b3ed324125fb1c02393568e3620117b90f5887f10cc839d717e902a9a637aac59e70a4da67810d690246b33d9ed09f6f38b8aedd2a0be
-
Meta Stealer Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-