General
- Target file.exe
- Size 356KB
- Sample221022-zh5htsefc6
- SHA256 a96538ece8662b0da63cbe74d64a5292dc5bd56f48bfe61cacd737bf8a18cb97
- MD5 02e65b5dcadffec48f78eebabcf3a509
- SHA1 68cbd7ce744a8643742c8b5cbfa69e1c8e3d94d7
- SHA512 e88462bb243222fe6bfb80a545e94225e558ab9aaa9802f19d05e7f027337b19ef15e9b98c7daf70f0a284c54cb4f9741faba26fa2c6cb60ffd26647604f3b46
- SSDEEP 6144:v80LDuBtWTmMWKVrdcO5HvI98xyPO9QGhYcucwk:v80XuBcT6upAexOOrYcucw
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
dozkey
C2
-
91.212.166.11:47242
Attributes
-
auth_value
6386fb6f33ca338f864abfc5f8fe1774
Targets
-
- Target file.exe
- Size 356KB
- SHA256 a96538ece8662b0da63cbe74d64a5292dc5bd56f48bfe61cacd737bf8a18cb97
- MD5 02e65b5dcadffec48f78eebabcf3a509
- SHA1 68cbd7ce744a8643742c8b5cbfa69e1c8e3d94d7
- SHA512 e88462bb243222fe6bfb80a545e94225e558ab9aaa9802f19d05e7f027337b19ef15e9b98c7daf70f0a284c54cb4f9741faba26fa2c6cb60ffd26647604f3b46
- SSDEEP 6144:v80LDuBtWTmMWKVrdcO5HvI98xyPO9QGhYcucwk:v80XuBcT6upAexOOrYcucw
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.