General
- Target file.exe
- Size 321KB
- Sample221104-dcqltsadf9
- SHA256 f962efafc2a1c0b5d8afe541943770189a761add54f068aab012a44fa40a8809
- MD5 5779cf0a0119e4403e1542f90fa90951
- SHA1 6cb2690ab33dc79e57e6d50b7d79d08a8e9579ea
- SHA512 e0ed30f1a403f5a89eb9718a7a2c5f45bddd76b109b7b3ada9c3a2ba3b239c826a17eb29669ce4d8e68d39151dcda02de0e9761753a27f3a0232b529b9d399c9
- SSDEEP 6144:9umNiMXLEYnjnit2m1W0eLSvsS4KIGyvtwo9G0WZQe5:I1IjiU0eLSvVzIGgdk
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
mix
C2
-
193.106.191.25:47242
Attributes
-
auth_value
5469d87831a100553f2f10d3aadec8bb
Targets
-
- Target file.exe
- Size 321KB
- SHA256 f962efafc2a1c0b5d8afe541943770189a761add54f068aab012a44fa40a8809
- MD5 5779cf0a0119e4403e1542f90fa90951
- SHA1 6cb2690ab33dc79e57e6d50b7d79d08a8e9579ea
- SHA512 e0ed30f1a403f5a89eb9718a7a2c5f45bddd76b109b7b3ada9c3a2ba3b239c826a17eb29669ce4d8e68d39151dcda02de0e9761753a27f3a0232b529b9d399c9
- SSDEEP 6144:9umNiMXLEYnjnit2m1W0eLSvsS4KIGyvtwo9G0WZQe5:I1IjiU0eLSvVzIGgdk
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.