General
- Target file.exe
- Size 356KB
- Sample221022-v39wtsebg4
- SHA256 1966323ff15fee4a7b6ac5c948e0a039cef4e05af70865c1d9d3d2fe3bf40251
- MD5 0246ee78c438efb0cba659d807a282ed
- SHA1 24171af02554dcf7593b385fa0eb2141e673668d
- SHA512 a22ded69581dcc853de20284597c1b113780ac9b7ac20d88d4afed67286291618f3b6c68324e74c3b74f9f13b8118864f8b7220cfb55c16392e2c260aa6d73d2
- SSDEEP 6144:B/OLHVVC5hIqg/tRy7/3Y1ayfdhFyr8feY2yAio6h:B/OrVVCXIqCtRCPdSdf1Fz
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
dozkey
C2
-
91.212.166.11:47242
Attributes
-
auth_value
6386fb6f33ca338f864abfc5f8fe1774
Targets
-
- Target file.exe
- Size 356KB
- SHA256 1966323ff15fee4a7b6ac5c948e0a039cef4e05af70865c1d9d3d2fe3bf40251
- MD5 0246ee78c438efb0cba659d807a282ed
- SHA1 24171af02554dcf7593b385fa0eb2141e673668d
- SHA512 a22ded69581dcc853de20284597c1b113780ac9b7ac20d88d4afed67286291618f3b6c68324e74c3b74f9f13b8118864f8b7220cfb55c16392e2c260aa6d73d2
- SSDEEP 6144:B/OLHVVC5hIqg/tRy7/3Y1ayfdhFyr8feY2yAio6h:B/OrVVCXIqCtRCPdSdf1Fz
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.