General
-
Target
638d41f2284bfc2b6197276dbfae09c638a42cbb5150c4d7c117a83cda2d81d2
-
Size
415KB
-
Sample
220521-rbjzjscgdr
-
MD5
fd0aa3448c0a9b3c3bcbcd5cb48df998
-
SHA1
f5ef12524403bea2b36c6d62604d6cdb64debc42
-
SHA256
638d41f2284bfc2b6197276dbfae09c638a42cbb5150c4d7c117a83cda2d81d2
-
SHA512
552f7ed23eaa1fc7de0b4fc8080720d80806c68c5e0399f152576b4b1a1e9429ab81aef8b70fead4baf6ebf1cadb6a0b7f8c2340a0db08f8ab36349659fc8ab6
Static task
static1
Malware Config
Extracted
redline
Ruzki
193.233.48.58:38989
-
auth_value
80c38cc7772c328c028b0e4f42a3fac6
Targets
-
-
Target
638d41f2284bfc2b6197276dbfae09c638a42cbb5150c4d7c117a83cda2d81d2
-
Size
415KB
-
MD5
fd0aa3448c0a9b3c3bcbcd5cb48df998
-
SHA1
f5ef12524403bea2b36c6d62604d6cdb64debc42
-
SHA256
638d41f2284bfc2b6197276dbfae09c638a42cbb5150c4d7c117a83cda2d81d2
-
SHA512
552f7ed23eaa1fc7de0b4fc8080720d80806c68c5e0399f152576b4b1a1e9429ab81aef8b70fead4baf6ebf1cadb6a0b7f8c2340a0db08f8ab36349659fc8ab6
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-