General
-
Target
ee39f4b62b7ab95fa0f9f3cd9075177387c3d167054b6863a4bd3e2ac0156b44
-
Size
361KB
-
Sample
220925-fvwxnsddd2
-
MD5
8ef59406ee3f5b9842837f0b93e8d72a
-
SHA1
6e902568bc8bd47d282e053a09d23b0148127489
-
SHA256
ee39f4b62b7ab95fa0f9f3cd9075177387c3d167054b6863a4bd3e2ac0156b44
-
SHA512
b11145ffcec8384f99d9bdad33b81f0b6629235aedc4d5d860fabfb43335c80e31081241d37e862f8c40723716fe6970ff35648f9bcc855a8796daff9723297a
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Targets
-
-
Target
ee39f4b62b7ab95fa0f9f3cd9075177387c3d167054b6863a4bd3e2ac0156b44
-
Size
361KB
-
MD5
8ef59406ee3f5b9842837f0b93e8d72a
-
SHA1
6e902568bc8bd47d282e053a09d23b0148127489
-
SHA256
ee39f4b62b7ab95fa0f9f3cd9075177387c3d167054b6863a4bd3e2ac0156b44
-
SHA512
b11145ffcec8384f99d9bdad33b81f0b6629235aedc4d5d860fabfb43335c80e31081241d37e862f8c40723716fe6970ff35648f9bcc855a8796daff9723297a
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-