General
- Target file.exe
- Size 350KB
- Sample221103-v3regsdab2
- SHA256 19a6fcd6ba12f86eb717e871872a46eba39dca0c3bdf9b2aecc97845f165b705
- MD5 e6f230df4abe691eba3e788332091327
- SHA1 0a71e96652b9760f3c1029172448fb535b1fe0d3
- SHA512 fa457ff2c6bbf958f62fb096f5b02b2ee2fe33124cc13c20072b7c8a22ca5bbeb047f4908890199589ab8c30cfb0c1c79c14b26b66344d1e0aa5915b4439d75d
- SSDEEP 6144:PxDwj9kkLEa4ATaEe7aOdfQznTD15XrwzOX+fSw:PxUhdAa4AWvWnn1Nwg+R
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
mix
C2
-
193.106.191.25:47242
Attributes
-
auth_value
5469d87831a100553f2f10d3aadec8bb
Targets
-
- Target file.exe
- Size 350KB
- SHA256 19a6fcd6ba12f86eb717e871872a46eba39dca0c3bdf9b2aecc97845f165b705
- MD5 e6f230df4abe691eba3e788332091327
- SHA1 0a71e96652b9760f3c1029172448fb535b1fe0d3
- SHA512 fa457ff2c6bbf958f62fb096f5b02b2ee2fe33124cc13c20072b7c8a22ca5bbeb047f4908890199589ab8c30cfb0c1c79c14b26b66344d1e0aa5915b4439d75d
- SSDEEP 6144:PxDwj9kkLEa4ATaEe7aOdfQznTD15XrwzOX+fSw:PxUhdAa4AWvWnn1Nwg+R
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.