General
- Target file.exe
- Size 410KB
- Sample221104-j3bhgsfdbl
- SHA256 63cd0c5a00f80d30895e7ca127f5f594025fcebbea529247b3aabe186f96efec
- MD5 a485d35344e3a1791bfc933cdc1c4107
- SHA1 455c5fc5e553bf522ce81ea83dc57a56cf5c4121
- SHA512 5c65b1af5da3f1408fe28821fe9787c91fd34ecc6cb857a5359426e40d2fa16fb0528c8167a311f7e8d5695615c4fb8ccfa8ea4ba8efbef82da28a55029a6f0d
- SSDEEP 6144:op7LwNYYZv8CvTFgBzeGwpVwoYdWlWQFn:op70NYe8Cv6pdCF
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
mix
C2
-
193.106.191.25:47242
Attributes
-
auth_value
5469d87831a100553f2f10d3aadec8bb
Targets
-
- Target file.exe
- Size 410KB
- SHA256 63cd0c5a00f80d30895e7ca127f5f594025fcebbea529247b3aabe186f96efec
- MD5 a485d35344e3a1791bfc933cdc1c4107
- SHA1 455c5fc5e553bf522ce81ea83dc57a56cf5c4121
- SHA512 5c65b1af5da3f1408fe28821fe9787c91fd34ecc6cb857a5359426e40d2fa16fb0528c8167a311f7e8d5695615c4fb8ccfa8ea4ba8efbef82da28a55029a6f0d
- SSDEEP 6144:op7LwNYYZv8CvTFgBzeGwpVwoYdWlWQFn:op70NYe8Cv6pdCF
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.