General
-
Target
220626-nf1lbacga6_pw_infected.zip
-
Size
270KB
-
Sample
220626-sjr6kadda5
-
MD5
d4b36a47ea5bdf52c48b85205e2b89a8
-
SHA1
de46f0dd41b443b20778f08b34d9958fa67e4051
-
SHA256
e7008e86b231466aac47960532409443e3c87fa88b87f4a84d92212f9f73992f
-
SHA512
cd721e6b916561dadfb9b585f571a50285d078100d9b4d1d5c37eaeb94a16952db4cd36002766e1983d3fb90fd97811a72ff2bc69efe87ec00a28a76a90f1946
Static task
static1
Behavioral task
behavioral1
Sample
23d08fc5df58949077d7eb666c166c38b5fd7d9c11ade50391cea0c52f1e414d.exe
Resource
win7-20220414-en
Malware Config
Extracted
redline
RUZKI
193.106.191.246:23196
-
auth_value
121027c094f768a0a0e9b562f6417952
Targets
-
-
Target
23d08fc5df58949077d7eb666c166c38b5fd7d9c11ade50391cea0c52f1e414d
-
Size
388KB
-
MD5
60b2c3699a2f14e52c44b640747b7100
-
SHA1
972ac78813a516807a0c61d305a4216d6a3ee369
-
SHA256
23d08fc5df58949077d7eb666c166c38b5fd7d9c11ade50391cea0c52f1e414d
-
SHA512
1a3338c03df43c1eda56a48362f7f3e83a83fb41cf27701f97b12e97ecac7b5f5b3c71a7cdc0f514e2219f62baa2e9e7d5f63ad48b91eb6f00f710a92dcd02b2
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Detects RedLine infostealer
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-