General
-
Target
595cd06110a5067c485933378e88e8df7775a71011174448bf49e15d60944360
-
Size
361KB
-
Sample
220925-f79djaegak
-
MD5
bf1190fe2c94bd3d731e3db0994eb73c
-
SHA1
764728c851c5a69a6c71fba3b1bdf9bd55824264
-
SHA256
595cd06110a5067c485933378e88e8df7775a71011174448bf49e15d60944360
-
SHA512
34004d9c36a58f809e91a651f124009f9e5c3f5a3c64fcdbf989fc7b19c86ce6c619ff6f33d57dcc731f1896a08b31781e876377ba390872e61212355329c220
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Targets
-
-
Target
595cd06110a5067c485933378e88e8df7775a71011174448bf49e15d60944360
-
Size
361KB
-
MD5
bf1190fe2c94bd3d731e3db0994eb73c
-
SHA1
764728c851c5a69a6c71fba3b1bdf9bd55824264
-
SHA256
595cd06110a5067c485933378e88e8df7775a71011174448bf49e15d60944360
-
SHA512
34004d9c36a58f809e91a651f124009f9e5c3f5a3c64fcdbf989fc7b19c86ce6c619ff6f33d57dcc731f1896a08b31781e876377ba390872e61212355329c220
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-