General
- Target file.exe
- Size 410KB
- Sample221104-halx3scdh3
- SHA256 d82effcbe405f4824e5b6f6b6f909d4d93ab6ff74b1ca4e59528ab22d407d1ad
- MD5 f785a4fff870117112c909afd8cba00f
- SHA1 b9dbc50b8a6937ff66ea468f2ed65f9a260aa252
- SHA512 4f5cf5abe75827b98ee2dd602d29ea6387fbd5c7eb040cb6617843417d6c06819ca9932e4f6bfece7e74257a832f096cf97f4377595d2977512b676d2aa27f9e
- SSDEEP 6144:MptLmHSYeFsCHMbEaNX8OwtM0JyyfrTaW/:MptiHSBdCllwtMSyyfrTaW
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
mix
C2
-
193.106.191.25:47242
Attributes
-
auth_value
5469d87831a100553f2f10d3aadec8bb
Targets
-
- Target file.exe
- Size 410KB
- SHA256 d82effcbe405f4824e5b6f6b6f909d4d93ab6ff74b1ca4e59528ab22d407d1ad
- MD5 f785a4fff870117112c909afd8cba00f
- SHA1 b9dbc50b8a6937ff66ea468f2ed65f9a260aa252
- SHA512 4f5cf5abe75827b98ee2dd602d29ea6387fbd5c7eb040cb6617843417d6c06819ca9932e4f6bfece7e74257a832f096cf97f4377595d2977512b676d2aa27f9e
- SSDEEP 6144:MptLmHSYeFsCHMbEaNX8OwtM0JyyfrTaW/:MptiHSBdCllwtMSyyfrTaW
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.