General
-
Target
bf4defa19f39c56ce003b1e7afea73c99554742f56b48dca2eb52a135d8cf0a5
-
Size
351KB
-
Sample
221028-gz5wtaega2
-
MD5
5954ba19214d4d4fc7350c2476a938fe
-
SHA1
9dd382dd17bc6eb7e8803c32c77ea27f16b07ad3
-
SHA256
bf4defa19f39c56ce003b1e7afea73c99554742f56b48dca2eb52a135d8cf0a5
-
SHA512
7aebeb535b6c725bdc417eaaee1489947154379ecd65514626f4ace57f4ceeab9d1c9e59edb58b9f1d96c3fc480d8c48ef896a8281fb143d32b33c81cea325f8
-
SSDEEP
6144:+QGsSYLKS0eHEYxn2vs1E/F9wWc30y3MRJbQd3PCtQb:+QGsSYyeli/A0PRJ+/Ct
Static task
static1
Malware Config
Extracted
redline
14
92.118.36.245:21100
-
auth_value
c509bb736d90e24a5f10c696dd374e6d
Targets
-
-
Target
bf4defa19f39c56ce003b1e7afea73c99554742f56b48dca2eb52a135d8cf0a5
-
Size
351KB
-
MD5
5954ba19214d4d4fc7350c2476a938fe
-
SHA1
9dd382dd17bc6eb7e8803c32c77ea27f16b07ad3
-
SHA256
bf4defa19f39c56ce003b1e7afea73c99554742f56b48dca2eb52a135d8cf0a5
-
SHA512
7aebeb535b6c725bdc417eaaee1489947154379ecd65514626f4ace57f4ceeab9d1c9e59edb58b9f1d96c3fc480d8c48ef896a8281fb143d32b33c81cea325f8
-
SSDEEP
6144:+QGsSYLKS0eHEYxn2vs1E/F9wWc30y3MRJbQd3PCtQb:+QGsSYyeli/A0PRJ+/Ct
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-