General
- Target 8942865f2de463a60382cf0b98aff5a2.exe
- Size 404KB
- Sample220524-qjxpyacbc4
- SHA256 1cd6554f09f75e739a84261f57defaa5d1f21a76cd6c36bdaac64baa2ba04625
- MD5 8942865f2de463a60382cf0b98aff5a2
- SHA1 9f60cbe3b0bc1134ae55dbc491a798c3fd1ae11b
- SHA512 14cc4291cdae4578460b6760553d45036160760814147be12196632f0341632b557ea4d1300eec29c781f6b661fe80edb5cd0f6b37ad550ee405ba7825dbedf8
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
8942865f2de463a60382cf0b98aff5a2.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
8942865f2de463a60382cf0b98aff5a2.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
mta
C2
-
193.106.191.222:23196
Attributes
-
auth_value
3d0a7300fdf6b2ac6ae9081b1a400e64
Targets
-
- Target 8942865f2de463a60382cf0b98aff5a2.exe
- Size 404KB
- SHA256 1cd6554f09f75e739a84261f57defaa5d1f21a76cd6c36bdaac64baa2ba04625
- MD5 8942865f2de463a60382cf0b98aff5a2
- SHA1 9f60cbe3b0bc1134ae55dbc491a798c3fd1ae11b
- SHA512 14cc4291cdae4578460b6760553d45036160760814147be12196632f0341632b557ea4d1300eec29c781f6b661fe80edb5cd0f6b37ad550ee405ba7825dbedf8
- MD5 SHA1 SHA512
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.