General
- Target file.exe
- Size 350KB
- Sample221024-ddal1aebdp
- SHA256 f266c8ee6eb9d3bd5b6837f32f36db8a641e767ac894b81cec6c2dc3ee19f0dd
- MD5 e10c6d5f4ac9ce8fac9853aae70336fc
- SHA1 9f95cb1efaa84d6fcc484287de99ce967e228812
- SHA512 1b61bf43a047fc2af34bb29df82f0b2860c62ae769f4d77878d45380be0238ab9174d720f9d1737a5436217d169b676539c0f1a317162601dcd79c7e77b06097
- SSDEEP 6144:GrLZD4a13TDP0/x/zYhhdGMSvvT0tiXe9X0v/0Z:GrFD4atTC9UwMSwtiWE
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
Dozkey
C2
-
91.212.166.17:47242
Attributes
-
auth_value
c06f8f31502cdaf6d673db7589189fd5
Targets
-
- Target file.exe
- Size 350KB
- SHA256 f266c8ee6eb9d3bd5b6837f32f36db8a641e767ac894b81cec6c2dc3ee19f0dd
- MD5 e10c6d5f4ac9ce8fac9853aae70336fc
- SHA1 9f95cb1efaa84d6fcc484287de99ce967e228812
- SHA512 1b61bf43a047fc2af34bb29df82f0b2860c62ae769f4d77878d45380be0238ab9174d720f9d1737a5436217d169b676539c0f1a317162601dcd79c7e77b06097
- SSDEEP 6144:GrLZD4a13TDP0/x/zYhhdGMSvvT0tiXe9X0v/0Z:GrFD4atTC9UwMSwtiWE
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.