General
- Target c0f2e1952a76fd21a37639020cd5c2ae.exe
- Size 333KB
- Sample220425-ya74badad6
- SHA256 e01e773caf023020551eafca4fb9a708ad0daa39ba84dc87031a7da11dca86e4
- MD5 c0f2e1952a76fd21a37639020cd5c2ae
- SHA1 2f086d6892ef4e91a75ec206369937001ac0ac67
- SHA512 b30b0db552538320648b30c154af95fed383557ef2478cf25499fd9831765e23b46de3b3a70e4957e07ea5b8887914955821c2c45ff5f5f615eab09f9cbbbf9c
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
c0f2e1952a76fd21a37639020cd5c2ae.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
55n
C2
-
193.106.191.78:23196
Attributes
-
auth_value
d4c98a069b6a23ac1d0ed81bca7e2857
Targets
-
- Target c0f2e1952a76fd21a37639020cd5c2ae.exe
- Size 333KB
- SHA256 e01e773caf023020551eafca4fb9a708ad0daa39ba84dc87031a7da11dca86e4
- MD5 c0f2e1952a76fd21a37639020cd5c2ae
- SHA1 2f086d6892ef4e91a75ec206369937001ac0ac67
- SHA512 b30b0db552538320648b30c154af95fed383557ef2478cf25499fd9831765e23b46de3b3a70e4957e07ea5b8887914955821c2c45ff5f5f615eab09f9cbbbf9c
- MD5 SHA1 SHA512
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.