General
-
Target
0849b276ad4104fd57d13437638a016c2ba745603693a927c48196a1deca25e1
-
Size
382KB
-
Sample
220624-dwct3scbc6
-
MD5
8c584612c55fe0b1c98f6250db452b6a
-
SHA1
7eb3ec72386bc521fcf6dc19d7d5262198b4e27a
-
SHA256
0849b276ad4104fd57d13437638a016c2ba745603693a927c48196a1deca25e1
-
SHA512
a9584b837e00220b958c2f64bf2504c8ab4dfe43de5a31bacf9f772d5ef19035dc772f97f9ebc1135fed100c0bd6b9fe320c7a8c80ad00304f82a10a6a6f9e65
Static task
static1
Malware Config
Extracted
redline
RUZKI
193.106.191.246:23196
-
auth_value
121027c094f768a0a0e9b562f6417952
Targets
-
-
Target
0849b276ad4104fd57d13437638a016c2ba745603693a927c48196a1deca25e1
-
Size
382KB
-
MD5
8c584612c55fe0b1c98f6250db452b6a
-
SHA1
7eb3ec72386bc521fcf6dc19d7d5262198b4e27a
-
SHA256
0849b276ad4104fd57d13437638a016c2ba745603693a927c48196a1deca25e1
-
SHA512
a9584b837e00220b958c2f64bf2504c8ab4dfe43de5a31bacf9f772d5ef19035dc772f97f9ebc1135fed100c0bd6b9fe320c7a8c80ad00304f82a10a6a6f9e65
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-