General
- Target 5c124e7b59f3516c7c82dde587c7f53e.exe
- Size 392KB
- Sample221028-rpkg8sfge4
- SHA256 5cef9640646eaec46b8b42280f606155a0880cf815120bc022dce5d1ac324ff4
- MD5 5c124e7b59f3516c7c82dde587c7f53e
- SHA1 d9b2e1ef518eb0ca3100e93878faf39af704f782
- SHA512 b4e3dae44f54620ed8230a5a5a61699590488c69f277358ba19fca99e60152a80d7a5c39a607864ac84332040088c0acda959162191775fe1133984e511c2c73
- SSDEEP 6144:frdHYLrjnOFlkHX/YcWnn06PsEoXnxleZvj7l+7YEggv4NA5:frdHYzn0lk3/Y9sEo3xlep7l+71v465
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
5c124e7b59f3516c7c82dde587c7f53e.exe
Resource
win7-20220812-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
doz
C2
-
193.106.191.21:47242
Attributes
-
auth_value
0c1f6245fdf34473eba636d447c5c2a3
Targets
-
- Target 5c124e7b59f3516c7c82dde587c7f53e.exe
- Size 392KB
- SHA256 5cef9640646eaec46b8b42280f606155a0880cf815120bc022dce5d1ac324ff4
- MD5 5c124e7b59f3516c7c82dde587c7f53e
- SHA1 d9b2e1ef518eb0ca3100e93878faf39af704f782
- SHA512 b4e3dae44f54620ed8230a5a5a61699590488c69f277358ba19fca99e60152a80d7a5c39a607864ac84332040088c0acda959162191775fe1133984e511c2c73
- SSDEEP 6144:frdHYLrjnOFlkHX/YcWnn06PsEoXnxleZvj7l+7YEggv4NA5:frdHYzn0lk3/Y9sEo3xlep7l+71v465
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.