General
-
Target
tmp
-
Size
310KB
-
Sample
220602-svn82sgga4
-
MD5
f920341ef1e2a7c9fb34a0d1c7f2baf2
-
SHA1
9e280bf23f975e229d2d7cfb3a0a9898cd884d70
-
SHA256
1d4d968ac653a358c34887f148bd2a44d742252432fbf7000d379c709da1cdb6
-
SHA512
6725a3a09b4028a0d7b4cf7c7cd1bd9ebec19be993f10a6d916c8f16882d22bf1fc2da0bb635128101429bdb537c5d6922d1368664d9643d6e42235c1b4be856
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
Malware Config
Extracted
redline
top
185.215.113.75:81
-
auth_value
ff6259bc2baf33b54b454aad484fb0ee
Targets
-
-
Target
tmp
-
Size
310KB
-
MD5
f920341ef1e2a7c9fb34a0d1c7f2baf2
-
SHA1
9e280bf23f975e229d2d7cfb3a0a9898cd884d70
-
SHA256
1d4d968ac653a358c34887f148bd2a44d742252432fbf7000d379c709da1cdb6
-
SHA512
6725a3a09b4028a0d7b4cf7c7cd1bd9ebec19be993f10a6d916c8f16882d22bf1fc2da0bb635128101429bdb537c5d6922d1368664d9643d6e42235c1b4be856
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-