General
- Target e394d7e540638b8e3fd2dbd3cff33c94.exe
- Size 406KB
- Sample220717-bc823aaecl
- SHA256 fadccfb4e4f78b3fa9a789e7a39e044658f3d9fe85322d024397ec229ba7c974
- MD5 e394d7e540638b8e3fd2dbd3cff33c94
- SHA1 6ed72d806f999d079c9fe2012d576e7a38573964
- SHA512 3c52a998506c889ceceb0396ff84b430745af505498508a61d5db4ef5cc15ac0885e6e837e2260218e7f9d63c63ccf8e1e10f1f92b3d87d80c52ec79c99c1736
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
e394d7e540638b8e3fd2dbd3cff33c94.exe
Resource
win7-20220715-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
adsfelix
C2
-
timenist.agency:80
Attributes
-
auth_value
14d72b624c4006b5e38741a8e1d4fbc2
Targets
-
- Target e394d7e540638b8e3fd2dbd3cff33c94.exe
- Size 406KB
- SHA256 fadccfb4e4f78b3fa9a789e7a39e044658f3d9fe85322d024397ec229ba7c974
- MD5 e394d7e540638b8e3fd2dbd3cff33c94
- SHA1 6ed72d806f999d079c9fe2012d576e7a38573964
- SHA512 3c52a998506c889ceceb0396ff84b430745af505498508a61d5db4ef5cc15ac0885e6e837e2260218e7f9d63c63ccf8e1e10f1f92b3d87d80c52ec79c99c1736
- MD5 SHA1 SHA512
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.