General
-
Target
80c13f8f37f99d317e408e98fff340db5c069fd9ab52614fb1a676801bf96673
-
Size
318KB
-
Sample
220531-naxmgaegaq
-
MD5
01a9391c499fd92ecfcd5ddf743b23a8
-
SHA1
18137cf8cb33b6ce71f584ef44ad938108a44fbd
-
SHA256
80c13f8f37f99d317e408e98fff340db5c069fd9ab52614fb1a676801bf96673
-
SHA512
9d6d8de1a858abc8e8a5b4f1eb4bb98845d0c55c54be8316c9fe6b50dc4c972f905df86a84a2d7a4e3b17db52cb5d5bbf5a9971fcf7612d3d9e8ce4d732eeaec
Static task
static1
Behavioral task
behavioral1
Sample
80c13f8f37f99d317e408e98fff340db5c069fd9ab52614fb1a676801bf96673.exe
Resource
win10-20220414-en
Malware Config
Extracted
redline
RuzkiUNIKALNO
193.233.48.58:38989
-
auth_value
c504b04cfbdd4bf85ce6195bcb37fba6
Targets
-
-
Target
80c13f8f37f99d317e408e98fff340db5c069fd9ab52614fb1a676801bf96673
-
Size
318KB
-
MD5
01a9391c499fd92ecfcd5ddf743b23a8
-
SHA1
18137cf8cb33b6ce71f584ef44ad938108a44fbd
-
SHA256
80c13f8f37f99d317e408e98fff340db5c069fd9ab52614fb1a676801bf96673
-
SHA512
9d6d8de1a858abc8e8a5b4f1eb4bb98845d0c55c54be8316c9fe6b50dc4c972f905df86a84a2d7a4e3b17db52cb5d5bbf5a9971fcf7612d3d9e8ce4d732eeaec
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-