General
- Target file.exe
- Size 441KB
- Sample221102-mpd81abbf8
- SHA256 2e2c53a60b2a7dc5aa73f4bc5dd62c8cd8869243238e494e19c15786b0e39b63
- MD5 d7f2dd21a40dd72a74425030d053619a
- SHA1 304f7b775912ab4ca8c401fb95e9e2f148bb07b3
- SHA512 92c700c1215ba2f105a3ccae8ee5b0fd88cd7e78c750d9b6891d2712c9dfabe45138010968066764fa6d45ec0baecab4eedfb4b871155d1aa3883c0b59ac77a5
- SSDEEP 6144:xU8renF41lG4nfBNdg2BtumGWHw5WWgbPJc7ITsq:W8oe1sgfLS2/MYw5/gbP27
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
mix
C2
-
193.106.191.25:47242
Attributes
-
auth_value
5469d87831a100553f2f10d3aadec8bb
Targets
-
- Target file.exe
- Size 441KB
- SHA256 2e2c53a60b2a7dc5aa73f4bc5dd62c8cd8869243238e494e19c15786b0e39b63
- MD5 d7f2dd21a40dd72a74425030d053619a
- SHA1 304f7b775912ab4ca8c401fb95e9e2f148bb07b3
- SHA512 92c700c1215ba2f105a3ccae8ee5b0fd88cd7e78c750d9b6891d2712c9dfabe45138010968066764fa6d45ec0baecab4eedfb4b871155d1aa3883c0b59ac77a5
- SSDEEP 6144:xU8renF41lG4nfBNdg2BtumGWHw5WWgbPJc7ITsq:W8oe1sgfLS2/MYw5/gbP27
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.