General
- Target 959df853a03cc48a3c5b3e2f541943ff.exe
- Size 392KB
- Sample220904-b1e4wsgagj
- SHA256 fd182dfc99b5055afee5c281a511c9b8c5716af9767a9e78e9eec90e0edeb1da
- MD5 959df853a03cc48a3c5b3e2f541943ff
- SHA1 d3b3ba4e2081461f4f226d57ce60c02a4e6912f0
- SHA512 f15d1774d3165469bafd1f6f36d67a010e2845c4ea609e3923bd548e38eb7fd62c658f3841d32c5e30a0a7363ee0998d2d4b3f7dcd0026ff7b6db0cd2957f8f8
- SSDEEP 6144:kpNJVzcoCJX7qd6qaDqEIp8lQiKADmCBB2:kpCr7qd6qamqlQTADp
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
959df853a03cc48a3c5b3e2f541943ff.exe
Resource
win7-20220812-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
twick
C2
-
trustedwicky.com:80
Attributes
-
auth_value
2284521981f16053dae08194ef371cb3
Targets
-
- Target 959df853a03cc48a3c5b3e2f541943ff.exe
- Size 392KB
- SHA256 fd182dfc99b5055afee5c281a511c9b8c5716af9767a9e78e9eec90e0edeb1da
- MD5 959df853a03cc48a3c5b3e2f541943ff
- SHA1 d3b3ba4e2081461f4f226d57ce60c02a4e6912f0
- SHA512 f15d1774d3165469bafd1f6f36d67a010e2845c4ea609e3923bd548e38eb7fd62c658f3841d32c5e30a0a7363ee0998d2d4b3f7dcd0026ff7b6db0cd2957f8f8
- SSDEEP 6144:kpNJVzcoCJX7qd6qaDqEIp8lQiKADmCBB2:kpCr7qd6qamqlQTADp
- MD5 SHA1 SHA512 SSDEEP
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.