General
- Target file.exe
- Size 379KB
- Sample221024-glathsehdn
- SHA256 b4447a4391e46c6a2aa54352e24ffaa942cb5fed36c93200ca797c8aed010113
- MD5 ff0fbee65fd83bfd6d7b9ac78236909e
- SHA1 8e44f9e4791207c778474507665cda32ac0d76f4
- SHA512 926d36a98dc9d521a4c8a852a6c61d1ba87cac003e4a1d39e8ad34bf04448210a470051b198b8f39673b6de746eda63987edc31430ed159ef5364b2f137be3f7
- SSDEEP 6144:Km3g/LMbvgyp3nbbZyRNRDQdX9VtIACAZHcA6cHXcR:Km36C4yp3HZyR7CVtGA5QcH
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
Dozkey
C2
-
91.212.166.17:47242
Attributes
-
auth_value
c06f8f31502cdaf6d673db7589189fd5
Targets
-
- Target file.exe
- Size 379KB
- SHA256 b4447a4391e46c6a2aa54352e24ffaa942cb5fed36c93200ca797c8aed010113
- MD5 ff0fbee65fd83bfd6d7b9ac78236909e
- SHA1 8e44f9e4791207c778474507665cda32ac0d76f4
- SHA512 926d36a98dc9d521a4c8a852a6c61d1ba87cac003e4a1d39e8ad34bf04448210a470051b198b8f39673b6de746eda63987edc31430ed159ef5364b2f137be3f7
- SSDEEP 6144:Km3g/LMbvgyp3nbbZyRNRDQdX9VtIACAZHcA6cHXcR:Km36C4yp3HZyR7CVtGA5QcH
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.