General
- Target file.exe
- Size 356KB
- Sample221022-rjd39sdfdm
- SHA256 12d6e79f85ad8ecc661f26bd5aae8e1b93e8620f859bf52afe5dfcc084d9ad5c
- MD5 7e3bbdd79254782e4f1903025aae0dc7
- SHA1 206a5b8122f11689cced6ba03de50b92e610564f
- SHA512 8e792a8d585f27f01e648dcfefe38e50bf724396a0ef910c00afd41b832a33b53695e5e5bdc803f3c89b583838b3732103c018efc5b0e3f01192dff29cf237c6
- SSDEEP 6144:vbLlbWptah608IGg+VvDruI7Shtl/l+c6:vbpbZwvg+ZDr4/l
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
dozkey
C2
-
91.212.166.11:47242
Attributes
-
auth_value
6386fb6f33ca338f864abfc5f8fe1774
Targets
-
- Target file.exe
- Size 356KB
- SHA256 12d6e79f85ad8ecc661f26bd5aae8e1b93e8620f859bf52afe5dfcc084d9ad5c
- MD5 7e3bbdd79254782e4f1903025aae0dc7
- SHA1 206a5b8122f11689cced6ba03de50b92e610564f
- SHA512 8e792a8d585f27f01e648dcfefe38e50bf724396a0ef910c00afd41b832a33b53695e5e5bdc803f3c89b583838b3732103c018efc5b0e3f01192dff29cf237c6
- SSDEEP 6144:vbLlbWptah608IGg+VvDruI7Shtl/l+c6:vbpbZwvg+ZDr4/l
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.