General
- Target 649eefa94a827d66ca4809e2a48d7358
- Size 315KB
- Sample220723-dqq5hsbhar
- SHA256 26fdf86fcee152ef6eb64db3ab973aa49d6f3ff7c840edea54c865dc3e6af72b
- MD5 649eefa94a827d66ca4809e2a48d7358
- SHA1 4d9f94048c0c74a366ed246e70d298ef262a7276
- SHA512 687158700887710995bbbbfca0c5db18892f3ef18c0823603d9ec31f8029cdd4d8f4eebbd38ae6d152485deec627900bb3806e0239b9548702d7578713d8cfed
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
649eefa94a827d66ca4809e2a48d7358.exe
Resource
win7-20220718-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
af
C2
-
trustamsty.com:80
Attributes
-
auth_value
f9fe99fb72fe095ae716b7093f75f872
Targets
-
- Target 649eefa94a827d66ca4809e2a48d7358
- Size 315KB
- SHA256 26fdf86fcee152ef6eb64db3ab973aa49d6f3ff7c840edea54c865dc3e6af72b
- MD5 649eefa94a827d66ca4809e2a48d7358
- SHA1 4d9f94048c0c74a366ed246e70d298ef262a7276
- SHA512 687158700887710995bbbbfca0c5db18892f3ef18c0823603d9ec31f8029cdd4d8f4eebbd38ae6d152485deec627900bb3806e0239b9548702d7578713d8cfed
- MD5 SHA1 SHA512
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.