General
- Target file.exe
- Size 321KB
- Sample221104-anw17shbf4
- SHA256 54463c0cd8c8293d0230818fcc7eaa2f54c149cbfc0be7984e08ee619831f941
- MD5 84ec72ee3768464fb2bff4046176473a
- SHA1 a92d581f43625d8cf115c92ff713db026ca26b59
- SHA512 d1fa652cf4e0eed8e869dfd54814f3cdd6ff2465c5eb269bbc59f16a1385f5cceeb1e196b46a5f5e643a2a4fba8e088916198f6af4fc77eda57fac7cb4af2c2b
- SSDEEP 6144:Nj76rjLdUM2kBoIsz/+lGfQP0yzr2nB+1Uw+dpzrXTV:RgjT6IY/+4IP0yG4neF5
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
mix
C2
-
193.106.191.25:47242
Attributes
-
auth_value
5469d87831a100553f2f10d3aadec8bb
Targets
-
- Target file.exe
- Size 321KB
- SHA256 54463c0cd8c8293d0230818fcc7eaa2f54c149cbfc0be7984e08ee619831f941
- MD5 84ec72ee3768464fb2bff4046176473a
- SHA1 a92d581f43625d8cf115c92ff713db026ca26b59
- SHA512 d1fa652cf4e0eed8e869dfd54814f3cdd6ff2465c5eb269bbc59f16a1385f5cceeb1e196b46a5f5e643a2a4fba8e088916198f6af4fc77eda57fac7cb4af2c2b
- SSDEEP 6144:Nj76rjLdUM2kBoIsz/+lGfQP0yzr2nB+1Uw+dpzrXTV:RgjT6IY/+4IP0yG4neF5
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.