General
- Target faaec90e9f7f830f51a721f108b67f31a918cb89d3f57.exe
- Size 420KB
- Sample220417-njt8pseddl
- SHA256 faaec90e9f7f830f51a721f108b67f31a918cb89d3f5745ca339a0d2b3f4fbca
- MD5 f4ad5e03a23fe8b83c4da64266311ea3
- SHA1 d5795f0c97d78056c2e33ea0cc2a0bc3ccb3ac69
- SHA512 650f1c8c732cf2b406cdb130f865c6ef63e6f72c51782540e6f92c1cc4d2637189e9412117d276db8ecd4686a7694937cdc9eb4b95cc7571602d7879bc0e92ae
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
faaec90e9f7f830f51a721f108b67f31a918cb89d3f57.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
55
C2
-
193.106.191.204:23196
Attributes
-
auth_value
4f084904929f42bfaee560d1d84cb568
Targets
-
- Target faaec90e9f7f830f51a721f108b67f31a918cb89d3f57.exe
- Size 420KB
- SHA256 faaec90e9f7f830f51a721f108b67f31a918cb89d3f5745ca339a0d2b3f4fbca
- MD5 f4ad5e03a23fe8b83c4da64266311ea3
- SHA1 d5795f0c97d78056c2e33ea0cc2a0bc3ccb3ac69
- SHA512 650f1c8c732cf2b406cdb130f865c6ef63e6f72c51782540e6f92c1cc4d2637189e9412117d276db8ecd4686a7694937cdc9eb4b95cc7571602d7879bc0e92ae
- MD5 SHA1 SHA512
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.