General
- Target 89e894f7df4017c3cd6f92a1b9d9b6c1.exe
- Size 289KB
- Sample220721-e2h4qacff9
- SHA256 cbabac9e2487ea63330c9bfa6ab55594f0a4fb0de7370b97f74cd62e2c72923e
- MD5 89e894f7df4017c3cd6f92a1b9d9b6c1
- SHA1 943d7a3a3fbfa94764c7a3963f6af750dd389291
- SHA512 79e15564cb500697791f8e05c7f89c31667809a6c3f6a8c1a9e66f17885b36c9d62755533ce7f08dbb87a0fb3ef9e41185942e16a938e4726003669d5550dcc9
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
89e894f7df4017c3cd6f92a1b9d9b6c1.exe
Resource
win7-20220715-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
adsfelix
C2
-
timenist.agency:80
Attributes
-
auth_value
14d72b624c4006b5e38741a8e1d4fbc2
Targets
-
- Target 89e894f7df4017c3cd6f92a1b9d9b6c1.exe
- Size 289KB
- SHA256 cbabac9e2487ea63330c9bfa6ab55594f0a4fb0de7370b97f74cd62e2c72923e
- MD5 89e894f7df4017c3cd6f92a1b9d9b6c1
- SHA1 943d7a3a3fbfa94764c7a3963f6af750dd389291
- SHA512 79e15564cb500697791f8e05c7f89c31667809a6c3f6a8c1a9e66f17885b36c9d62755533ce7f08dbb87a0fb3ef9e41185942e16a938e4726003669d5550dcc9
- MD5 SHA1 SHA512
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.