General
- Target 0a4caf496ba8cbdb4d22f7f23b960197.exe
- Size 339KB
- Sample220723-tmx2nafehr
- SHA256 d8a321cf50e3eee9a674fd6589de1be9180c9c77e61aa052e63acb24dc5f4fb8
- MD5 0a4caf496ba8cbdb4d22f7f23b960197
- SHA1 d560bf84bc2ac909a6069839c998bba00cebdf5a
- SHA512 606bb99d3b98831dd4ceffefa4a0cd37723800b97ec93019fffd449c143f4e89b5587c316b75b87707686c2f53ff7dd4c4e43df14c75d2993a08e6f36c584394
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
0a4caf496ba8cbdb4d22f7f23b960197.exe
Resource
win7-20220715-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
af
C2
-
trustamsty.com:80
Attributes
-
auth_value
f9fe99fb72fe095ae716b7093f75f872
Targets
-
- Target 0a4caf496ba8cbdb4d22f7f23b960197.exe
- Size 339KB
- SHA256 d8a321cf50e3eee9a674fd6589de1be9180c9c77e61aa052e63acb24dc5f4fb8
- MD5 0a4caf496ba8cbdb4d22f7f23b960197
- SHA1 d560bf84bc2ac909a6069839c998bba00cebdf5a
- SHA512 606bb99d3b98831dd4ceffefa4a0cd37723800b97ec93019fffd449c143f4e89b5587c316b75b87707686c2f53ff7dd4c4e43df14c75d2993a08e6f36c584394
- MD5 SHA1 SHA512
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.