General
-
Target
a594194e75e61b9d12c59ccdaeb69338d61aa036392c53435ac219067947c50d
-
Size
361KB
-
Sample
220925-dzbfesedam
-
MD5
24ddcc38748b4bdc0d416a05ee348b06
-
SHA1
d56eb3d8ee4d5faf2841e85a0c814723829cf28b
-
SHA256
a594194e75e61b9d12c59ccdaeb69338d61aa036392c53435ac219067947c50d
-
SHA512
45be05a111e278b7396905ed7d702b337050dde706bd371813391ea4e997d6345a7ed0a6e47e1fdc152f08d8166e9c7dd07d24eff4dc603f9a97e839110f2cdf
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Targets
-
-
Target
a594194e75e61b9d12c59ccdaeb69338d61aa036392c53435ac219067947c50d
-
Size
361KB
-
MD5
24ddcc38748b4bdc0d416a05ee348b06
-
SHA1
d56eb3d8ee4d5faf2841e85a0c814723829cf28b
-
SHA256
a594194e75e61b9d12c59ccdaeb69338d61aa036392c53435ac219067947c50d
-
SHA512
45be05a111e278b7396905ed7d702b337050dde706bd371813391ea4e997d6345a7ed0a6e47e1fdc152f08d8166e9c7dd07d24eff4dc603f9a97e839110f2cdf
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-