General
- Target edf44753b503b48a3c8e65ad75933efd.exe
- Size 334KB
- Sample220725-hmhfesbabr
- SHA256 3eb07fe360c99a1a0be06f31be2ae0a059135ab4f8593b27303fdf0d4c8b89cc
- MD5 edf44753b503b48a3c8e65ad75933efd
- SHA1 f5929989297f29d64c58e0266161ef77f31e9ecb
- SHA512 e20bed434c540465c29ca0b01b7dc2c05e5eb5e91eab4fa7130a2c66b9388683ea01f93c7910babae61327ed5bf73f851cd5d97e8e41b196b105e8d1d14a87b6
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
edf44753b503b48a3c8e65ad75933efd.exe
Resource
win7-20220718-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
af
C2
-
trustamsty.com:80
Attributes
-
auth_value
f9fe99fb72fe095ae716b7093f75f872
Targets
-
- Target edf44753b503b48a3c8e65ad75933efd.exe
- Size 334KB
- SHA256 3eb07fe360c99a1a0be06f31be2ae0a059135ab4f8593b27303fdf0d4c8b89cc
- MD5 edf44753b503b48a3c8e65ad75933efd
- SHA1 f5929989297f29d64c58e0266161ef77f31e9ecb
- SHA512 e20bed434c540465c29ca0b01b7dc2c05e5eb5e91eab4fa7130a2c66b9388683ea01f93c7910babae61327ed5bf73f851cd5d97e8e41b196b105e8d1d14a87b6
- MD5 SHA1 SHA512
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.