General
- Target file.exe
- Size 321KB
- Sample221104-cgpdwsaac4
- SHA256 8540bf2c4f74a4ab1b9cf19ab897de3b409aeff6b93c942e8397377aaa77809b
- MD5 486fd872177a735c304372c05099d276
- SHA1 9e6d0dab5addd93ae2a73cc7002c660a12e421bc
- SHA512 3aa65e86e4047f8564cf862f3a32c2cfdd02c14c19c7e80e5efc393a1f09be56c2afa7d102bb5f4e01a127719f86fbcc8024fd886c9649009757b25a3eb389a9
- SSDEEP 6144:kb9NBbL0XABTY4vklPOU1uVDv/hEbz5ZaXCNXnF+Fv6Rg/:Q5b+WTIlF8VCqSNXn1A
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
mix
C2
-
193.106.191.25:47242
Attributes
-
auth_value
5469d87831a100553f2f10d3aadec8bb
Targets
-
- Target file.exe
- Size 321KB
- SHA256 8540bf2c4f74a4ab1b9cf19ab897de3b409aeff6b93c942e8397377aaa77809b
- MD5 486fd872177a735c304372c05099d276
- SHA1 9e6d0dab5addd93ae2a73cc7002c660a12e421bc
- SHA512 3aa65e86e4047f8564cf862f3a32c2cfdd02c14c19c7e80e5efc393a1f09be56c2afa7d102bb5f4e01a127719f86fbcc8024fd886c9649009757b25a3eb389a9
- SSDEEP 6144:kb9NBbL0XABTY4vklPOU1uVDv/hEbz5ZaXCNXnF+Fv6Rg/:Q5b+WTIlF8VCqSNXn1A
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.