General
- Target file.exe
- Size 350KB
- Sample221103-qfhrlsaee3
- SHA256 c3aee3ca9ae334fb355f4f82de954bc736c6b2f4c9c24be523c432c36b63b6fd
- MD5 0cc17554e9a47f5f02caa62a5c41a230
- SHA1 30bd26aad5d0ee83fc057f4ef0c14e7111b39a8a
- SHA512 ad89a9cd97a73e73bf8cc0408824fc58bcb7017290ae3838d0c001976d6b3a879698aa94b484531524669e533a236716300113513079db4e17f1abac82de4d9e
- SSDEEP 6144:iuMcoqoEL7lgC5S8NqNmihj2FbO7oR+qDWE42/jZXw:iuDBBWC57wdhobO7HUWQA
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
mix
C2
-
193.106.191.25:47242
Attributes
-
auth_value
5469d87831a100553f2f10d3aadec8bb
Targets
-
- Target file.exe
- Size 350KB
- SHA256 c3aee3ca9ae334fb355f4f82de954bc736c6b2f4c9c24be523c432c36b63b6fd
- MD5 0cc17554e9a47f5f02caa62a5c41a230
- SHA1 30bd26aad5d0ee83fc057f4ef0c14e7111b39a8a
- SHA512 ad89a9cd97a73e73bf8cc0408824fc58bcb7017290ae3838d0c001976d6b3a879698aa94b484531524669e533a236716300113513079db4e17f1abac82de4d9e
- SSDEEP 6144:iuMcoqoEL7lgC5S8NqNmihj2FbO7oR+qDWE42/jZXw:iuDBBWC57wdhobO7HUWQA
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.