General
- Target file.exe
- Size 370KB
- Sample221026-s6292sgbd4
- SHA256 cf1ede8cedaf26e5965d0dfc652e14fde966b1bf4bcc77b43985c2b4e3492ef3
- MD5 9d597241b6c62dde42f9ef704182fcdb
- SHA1 e2120e7ae46241bd5237ac7f5bc99a434e9c69af
- SHA512 55d03db0a8827d7386835a5b82fb6a0e6bc3c394fea1d0aa199753225482c73c0815309cea16ad23fe033be1aa6242ce44513e5f4298c4acd921d71dd64805f6
- SSDEEP 6144:z4DHl+oLaQa7sCiRWCAVAP++y6G51SYbva1fqVh+ho+Ov1I:z4DF+o217oAVE++y6G5plVh+mu
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
dzkey
C2
-
193.106.191.19:47242
Attributes
-
auth_value
52a449fd61ad73c3abc266d47c699ceb
Targets
-
- Target file.exe
- Size 370KB
- SHA256 cf1ede8cedaf26e5965d0dfc652e14fde966b1bf4bcc77b43985c2b4e3492ef3
- MD5 9d597241b6c62dde42f9ef704182fcdb
- SHA1 e2120e7ae46241bd5237ac7f5bc99a434e9c69af
- SHA512 55d03db0a8827d7386835a5b82fb6a0e6bc3c394fea1d0aa199753225482c73c0815309cea16ad23fe033be1aa6242ce44513e5f4298c4acd921d71dd64805f6
- SSDEEP 6144:z4DHl+oLaQa7sCiRWCAVAP++y6G51SYbva1fqVh+ho+Ov1I:z4DF+o217oAVE++y6G5plVh+mu
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.