General
-
Target
5ee80998f0afa25b71cfff837472f07c1cbbf617807a99ff83d05a5e0bf33493
-
Size
361KB
-
Sample
220925-d45j3adad8
-
MD5
d8102a8e174d1faee3bb4cc871ee3ab8
-
SHA1
145bb1790209196014f4ffc27e6ca592bf47f072
-
SHA256
5ee80998f0afa25b71cfff837472f07c1cbbf617807a99ff83d05a5e0bf33493
-
SHA512
9bc392fd9436abf697310662261a83bcd6052f7a6adceb2ed97053e45d3c95b0a83f98f8ecd98c29da05b7cd05a3ee1ccfe8b67099ce45ae2efbcb9a817f82da
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Targets
-
-
Target
5ee80998f0afa25b71cfff837472f07c1cbbf617807a99ff83d05a5e0bf33493
-
Size
361KB
-
MD5
d8102a8e174d1faee3bb4cc871ee3ab8
-
SHA1
145bb1790209196014f4ffc27e6ca592bf47f072
-
SHA256
5ee80998f0afa25b71cfff837472f07c1cbbf617807a99ff83d05a5e0bf33493
-
SHA512
9bc392fd9436abf697310662261a83bcd6052f7a6adceb2ed97053e45d3c95b0a83f98f8ecd98c29da05b7cd05a3ee1ccfe8b67099ce45ae2efbcb9a817f82da
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-