General
-
Target
b0806380ad29af82637c2f4e8964b6a6507e78b081bb8b0cd89cf9d5ff812a3b
-
Size
361KB
-
Sample
220925-gfd9raegcl
-
MD5
f08f8fef214946d542a8bddbf3857390
-
SHA1
09f243742c2b3e89ca2a3386ade7f1fda05a82e7
-
SHA256
b0806380ad29af82637c2f4e8964b6a6507e78b081bb8b0cd89cf9d5ff812a3b
-
SHA512
5cb849a15b0acc7a19b9c53452b0c817287b671c3be7e94f6e9c1d87e8f8bd9015e54fb50eedae257234d17968992f2942a506b7369484d98708973e95727117
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Targets
-
-
Target
b0806380ad29af82637c2f4e8964b6a6507e78b081bb8b0cd89cf9d5ff812a3b
-
Size
361KB
-
MD5
f08f8fef214946d542a8bddbf3857390
-
SHA1
09f243742c2b3e89ca2a3386ade7f1fda05a82e7
-
SHA256
b0806380ad29af82637c2f4e8964b6a6507e78b081bb8b0cd89cf9d5ff812a3b
-
SHA512
5cb849a15b0acc7a19b9c53452b0c817287b671c3be7e94f6e9c1d87e8f8bd9015e54fb50eedae257234d17968992f2942a506b7369484d98708973e95727117
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-