General
- Target file.exe
- Size 411KB
- Sample221103-e5ynkseeb7
- SHA256 740261f3723c26ef79900e8be0c48923c22594756e90c56d653ed17be15d4ba8
- MD5 cd95ac2350fb84a9854c8810c5880dbd
- SHA1 cb68f19fa2c4bbf7d8c87359b9f1c6ae450db11d
- SHA512 316b43b975da3108b9160cd5769110241a1bd6e148d1528f26bcb34e24231181b85be0004b5409409a0886f7b9e52c73b31f0c1772929391cd6884c3ba51fdb4
- SSDEEP 6144:hBLLVXmLMD422NwbQxMzEUuSJIch23mr4Smr9cpoby1rutNJRE7I:hBLRXuMl/7zEUuSJIs8ipr1qzJi7
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
mix
C2
-
193.106.191.25:47242
Attributes
-
auth_value
5469d87831a100553f2f10d3aadec8bb
Targets
-
- Target file.exe
- Size 411KB
- SHA256 740261f3723c26ef79900e8be0c48923c22594756e90c56d653ed17be15d4ba8
- MD5 cd95ac2350fb84a9854c8810c5880dbd
- SHA1 cb68f19fa2c4bbf7d8c87359b9f1c6ae450db11d
- SHA512 316b43b975da3108b9160cd5769110241a1bd6e148d1528f26bcb34e24231181b85be0004b5409409a0886f7b9e52c73b31f0c1772929391cd6884c3ba51fdb4
- SSDEEP 6144:hBLLVXmLMD422NwbQxMzEUuSJIch23mr4Smr9cpoby1rutNJRE7I:hBLRXuMl/7zEUuSJIs8ipr1qzJi7
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.