General
- Target file.exe
- Size 405KB
- Sample221104-1d62jabcd3
- SHA256 79af2d9ea5db442d420dfca7cb1f7ffaf3abd901aaed2464315bf99d5d215c8e
- MD5 e75c89a0cdacc37f2c02f677f4865d49
- SHA1 d8a7e8bb110c78ee767a81d5bf247b6a5089141d
- SHA512 5f15c4247413206f6fc5cb6596be2b7380bbb8aed3b182a3ca09c9fac692a25a6b32e5b4640140c5bddc9f4e04dc21176a66c164bb84d45627036a4ff6b3de55
- SSDEEP 6144:gTA69azd3f4jMecYa8UDHs4/0LywNtYO6g07NYbSzv:gTAbJvqMeJcHbt2
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
suk
C2
-
193.106.191.25:47242
Attributes
-
auth_value
9762d5bcad64c7855837e80c232c7e77
Targets
-
- Target file.exe
- Size 405KB
- SHA256 79af2d9ea5db442d420dfca7cb1f7ffaf3abd901aaed2464315bf99d5d215c8e
- MD5 e75c89a0cdacc37f2c02f677f4865d49
- SHA1 d8a7e8bb110c78ee767a81d5bf247b6a5089141d
- SHA512 5f15c4247413206f6fc5cb6596be2b7380bbb8aed3b182a3ca09c9fac692a25a6b32e5b4640140c5bddc9f4e04dc21176a66c164bb84d45627036a4ff6b3de55
- SSDEEP 6144:gTA69azd3f4jMecYa8UDHs4/0LywNtYO6g07NYbSzv:gTAbJvqMeJcHbt2
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.