General
- Target file.exe
- Size 391KB
- Sample221027-srxe9acfek
- SHA256 714605ca7ffd745319c1939bbb649038ed72adb8e4e6eb2818e22775dd5357e0
- MD5 b27077c3ad5df574f29fed580b78c24e
- SHA1 c88944b9dd1ac3661173e63887c331ed6b0cd8bc
- SHA512 86b1fedb4e689a8db03c4c534f6b1adff96c2eb3c588cb70d295252e36d252d39d0acb0e0678ef181721c0d92d8ccad6d805549e58869ff10be1e1fe0e5d88ab
- SSDEEP 6144:IMZoyrPJVvB/A5Qa6686ezZBn7GNetGLpW/071Ppzfd0i:IgoyrPJVO5QazEznnseoWiBze
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
dzkey
C2
-
193.106.191.19:47242
Attributes
-
auth_value
52a449fd61ad73c3abc266d47c699ceb
Targets
-
- Target file.exe
- Size 391KB
- SHA256 714605ca7ffd745319c1939bbb649038ed72adb8e4e6eb2818e22775dd5357e0
- MD5 b27077c3ad5df574f29fed580b78c24e
- SHA1 c88944b9dd1ac3661173e63887c331ed6b0cd8bc
- SHA512 86b1fedb4e689a8db03c4c534f6b1adff96c2eb3c588cb70d295252e36d252d39d0acb0e0678ef181721c0d92d8ccad6d805549e58869ff10be1e1fe0e5d88ab
- SSDEEP 6144:IMZoyrPJVvB/A5Qa6686ezZBn7GNetGLpW/071Ppzfd0i:IgoyrPJVO5QazEznnseoWiBze
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.