General
- Target 5928cb12a89591d33e5f4acf6656bd99.exe
- Size 341KB
- Sample220715-pebfgaade9
- SHA256 961413e7d0190338e9123f8dcbb5ff59fb85edea96cfb250bc61e8fd7c48dda0
- MD5 5928cb12a89591d33e5f4acf6656bd99
- SHA1 3dda72b2798d4a1b698b23f34285e0d4ff51cde7
- SHA512 21e06955df57ad967217ae5f6aebaf08551520f689f71ad44d3027dd3304a6649b27ab92c748375412bbac3ed9d71c0c720df7191fcb96875c7b8c96e73ea5c6
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
5928cb12a89591d33e5f4acf6656bd99.exe
Resource
win7-20220414-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
RZ
C2
-
193.106.191.81:23196
Attributes
-
auth_value
4f816b599d2b63fb976620fbf8dcfd11
Targets
-
- Target 5928cb12a89591d33e5f4acf6656bd99.exe
- Size 341KB
- SHA256 961413e7d0190338e9123f8dcbb5ff59fb85edea96cfb250bc61e8fd7c48dda0
- MD5 5928cb12a89591d33e5f4acf6656bd99
- SHA1 3dda72b2798d4a1b698b23f34285e0d4ff51cde7
- SHA512 21e06955df57ad967217ae5f6aebaf08551520f689f71ad44d3027dd3304a6649b27ab92c748375412bbac3ed9d71c0c720df7191fcb96875c7b8c96e73ea5c6
- MD5 SHA1 SHA512
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.