General
- Target 3bfcb67573bfb21edb4937ea88fe1041.exe
- Size 404KB
- Sample220524-w92dpsddh7
- SHA256 8e9b2b163339bd92f5201e004944cd8558829f85c345a82e78a303e3afa1fa32
- MD5 3bfcb67573bfb21edb4937ea88fe1041
- SHA1 d03f6406164ead02c3a7a8cf0f3f1a84102926ed
- SHA512 6432370f38e1556a79954908162f863dc3b840eaca0888c8251f7accc4a3a0765d85ec5b75d3067bc61370d25dd8201937d157d4726f1d1da535cc5439b873d3
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
3bfcb67573bfb21edb4937ea88fe1041.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3bfcb67573bfb21edb4937ea88fe1041.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
mta
C2
-
193.106.191.222:23196
Attributes
-
auth_value
3d0a7300fdf6b2ac6ae9081b1a400e64
Targets
-
- Target 3bfcb67573bfb21edb4937ea88fe1041.exe
- Size 404KB
- SHA256 8e9b2b163339bd92f5201e004944cd8558829f85c345a82e78a303e3afa1fa32
- MD5 3bfcb67573bfb21edb4937ea88fe1041
- SHA1 d03f6406164ead02c3a7a8cf0f3f1a84102926ed
- SHA512 6432370f38e1556a79954908162f863dc3b840eaca0888c8251f7accc4a3a0765d85ec5b75d3067bc61370d25dd8201937d157d4726f1d1da535cc5439b873d3
- MD5 SHA1 SHA512
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.