General
-
Target
tmp
-
Size
407KB
-
Sample
220522-ln3pjaheh7
-
MD5
757831124d3d3ae257dc79e3f90d1245
-
SHA1
ec36820c20d6332eb022e10770fd3df68d9666e2
-
SHA256
081e914dcc2ef589bd86fc0a8f7a9eb7fab408c2069f0d76692d60f8f0723a2a
-
SHA512
e89e784cc7dd29190011f2db5395406c67474895a835300a0b6fc93adc8a2b1c2a5170e1b7b8eb058ddc581ce07a00947cff1548658748a4c8bddb06f51dab6b
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
Malware Config
Extracted
redline
meta1
193.106.191.182:23196
-
auth_value
9a16ce2cecb89012977449117f5e8d58
Targets
-
-
Target
tmp
-
Size
407KB
-
MD5
757831124d3d3ae257dc79e3f90d1245
-
SHA1
ec36820c20d6332eb022e10770fd3df68d9666e2
-
SHA256
081e914dcc2ef589bd86fc0a8f7a9eb7fab408c2069f0d76692d60f8f0723a2a
-
SHA512
e89e784cc7dd29190011f2db5395406c67474895a835300a0b6fc93adc8a2b1c2a5170e1b7b8eb058ddc581ce07a00947cff1548658748a4c8bddb06f51dab6b
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-