General
- Target file.exe
- Size 405KB
- Sample221105-s5b2gageb5
- SHA256 50d45a9b2e32109b6ff6b06fdfb93bb3ef720dfb7feea9bd1e291f165b637362
- MD5 b3d5f5517e8dae6756babf8b3e37d914
- SHA1 799643ab16e67b74be22a620ee6ee9375826d961
- SHA512 cd023ca509aabc0f299fa76f3018768604369e4cfb250ee34deed64565f2b20d6292a026dfebbff5491ee608cf449b187a375551d0497b8aadc85825d37d23e3
- SSDEEP 6144:xqqtNFCrLgaUd1OQfcHDl3jWbu/ijaryF/pPGs:xqIMLgauXel9/4aCG
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
suk
C2
-
193.106.191.25:47242
Attributes
-
auth_value
9762d5bcad64c7855837e80c232c7e77
Targets
-
- Target file.exe
- Size 405KB
- SHA256 50d45a9b2e32109b6ff6b06fdfb93bb3ef720dfb7feea9bd1e291f165b637362
- MD5 b3d5f5517e8dae6756babf8b3e37d914
- SHA1 799643ab16e67b74be22a620ee6ee9375826d961
- SHA512 cd023ca509aabc0f299fa76f3018768604369e4cfb250ee34deed64565f2b20d6292a026dfebbff5491ee608cf449b187a375551d0497b8aadc85825d37d23e3
- SSDEEP 6144:xqqtNFCrLgaUd1OQfcHDl3jWbu/ijaryF/pPGs:xqIMLgauXel9/4aCG
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.