General
-
Target
aaa6f645a77e0fee6de3c58dcea3c6f7c1346209b8b135891a147a9fef2d59cb
-
Size
361KB
-
Sample
220925-d6plmadaf4
-
MD5
d8c918f1cc0357e5213be0328ea36a04
-
SHA1
b06a59d9d253a5d758d2c27741778243af3c18a6
-
SHA256
aaa6f645a77e0fee6de3c58dcea3c6f7c1346209b8b135891a147a9fef2d59cb
-
SHA512
a9a0b52a27b28287be4893a05d6817dce6ea6e3811d5468005dd01df6bcfb7163892094bd4b6c4d37e9e0f03cd435ecfa6610cc0d8f214ba7367272ebb97883c
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Targets
-
-
Target
aaa6f645a77e0fee6de3c58dcea3c6f7c1346209b8b135891a147a9fef2d59cb
-
Size
361KB
-
MD5
d8c918f1cc0357e5213be0328ea36a04
-
SHA1
b06a59d9d253a5d758d2c27741778243af3c18a6
-
SHA256
aaa6f645a77e0fee6de3c58dcea3c6f7c1346209b8b135891a147a9fef2d59cb
-
SHA512
a9a0b52a27b28287be4893a05d6817dce6ea6e3811d5468005dd01df6bcfb7163892094bd4b6c4d37e9e0f03cd435ecfa6610cc0d8f214ba7367272ebb97883c
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-