General
- Target c8da8ce50b045e07b8115676a13717a6.exe
- Size 342KB
- Sample220628-e3m43afbam
- SHA256 37835fd541311503e6f9d9f751a2a78eb7dd593000e92c2161cb919238aefb29
- MD5 c8da8ce50b045e07b8115676a13717a6
- SHA1 644ad48d91fbb23232cec26824e8ab2957aab15c
- SHA512 74bd10e4c08afd999fd1f68adb57f1046eaf9e6e7324b1e6a75ba69113759e174227cd1b41ba3e1a4ee1b29abddabd0860d20865690d9af4ba186d19945b4a89
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
c8da8ce50b045e07b8115676a13717a6.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
ruzkii
C2
-
193.106.191.81:23196
Attributes
-
auth_value
a2e61f725b549c0f63f5055c64a5b701
Targets
-
- Target c8da8ce50b045e07b8115676a13717a6.exe
- Size 342KB
- SHA256 37835fd541311503e6f9d9f751a2a78eb7dd593000e92c2161cb919238aefb29
- MD5 c8da8ce50b045e07b8115676a13717a6
- SHA1 644ad48d91fbb23232cec26824e8ab2957aab15c
- SHA512 74bd10e4c08afd999fd1f68adb57f1046eaf9e6e7324b1e6a75ba69113759e174227cd1b41ba3e1a4ee1b29abddabd0860d20865690d9af4ba186d19945b4a89
- MD5 SHA1 SHA512
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.