General
- Target 1b40311882959d78f78ed791776c2916.exe
- Size 391KB
- Sample220903-k2qrfsfbb5
- SHA256 eb906b5a888917578d28f266077ffbf650fd5be52b86bde3eafbadfa38a29d37
- MD5 1b40311882959d78f78ed791776c2916
- SHA1 248d61a69159fa9345efaab613b996fe351ef7d9
- SHA512 1e40122cec0158ebe52be59f3abafb034779d126a45ba176d6800dabcd4551188c59d9a5fd15a69c9c2c057345673f95b847acdfc31b4cbce3b83ef44a45f9ab
- SSDEEP 6144:CsoOuSxOBL1Q4rR41WJa9W29c2X8A3DpygFulf:CpjT41Lz9LX8Alyp
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
1b40311882959d78f78ed791776c2916.exe
Resource
win7-20220812-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
twick
C2
-
trustedwicky.com:80
Attributes
-
auth_value
2284521981f16053dae08194ef371cb3
Targets
-
- Target 1b40311882959d78f78ed791776c2916.exe
- Size 391KB
- SHA256 eb906b5a888917578d28f266077ffbf650fd5be52b86bde3eafbadfa38a29d37
- MD5 1b40311882959d78f78ed791776c2916
- SHA1 248d61a69159fa9345efaab613b996fe351ef7d9
- SHA512 1e40122cec0158ebe52be59f3abafb034779d126a45ba176d6800dabcd4551188c59d9a5fd15a69c9c2c057345673f95b847acdfc31b4cbce3b83ef44a45f9ab
- SSDEEP 6144:CsoOuSxOBL1Q4rR41WJa9W29c2X8A3DpygFulf:CpjT41Lz9LX8Alyp
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.