General
- Target file.exe
- Size 356KB
- Sample221022-qthnrsdcf6
- SHA256 0d9623fa6d328b356a3799643b6fc4ac111d96ece622adebd10cbd4d9e7f0278
- MD5 fe9e4e40797cf256f521802f00b22659
- SHA1 fc95bf4d492bff6273f31cdf260d51a4191ebf61
- SHA512 9594955bd21734f1ecbb12b64eebb7730e2f285fe4c32506d7085a261c7c46e743c9a38d7752fff7948b5037b5cec986cd2d1f8c0a0e9b5ed075b692c617fa18
- SSDEEP 6144:sJPL0vdMCDk03kk3RI3GM5bo8buWGoBStPMdLbeocJIYLCxW:sB4vQyX3R1cb8FtSiocl
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
dozkey
C2
-
91.212.166.11:47242
Attributes
-
auth_value
6386fb6f33ca338f864abfc5f8fe1774
Targets
-
- Target file.exe
- Size 356KB
- SHA256 0d9623fa6d328b356a3799643b6fc4ac111d96ece622adebd10cbd4d9e7f0278
- MD5 fe9e4e40797cf256f521802f00b22659
- SHA1 fc95bf4d492bff6273f31cdf260d51a4191ebf61
- SHA512 9594955bd21734f1ecbb12b64eebb7730e2f285fe4c32506d7085a261c7c46e743c9a38d7752fff7948b5037b5cec986cd2d1f8c0a0e9b5ed075b692c617fa18
- SSDEEP 6144:sJPL0vdMCDk03kk3RI3GM5bo8buWGoBStPMdLbeocJIYLCxW:sB4vQyX3R1cb8FtSiocl
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.