General
- Target file.exe
- Size 346KB
- Sample221115-m5nsdade65
- SHA256 8cc7f8c2814caed95fd4dfd859eaa1bcca2771fc7c5111854f20b28de8928a5a
- MD5 0e075bcf9cf63d274fadb5b9b4357e5c
- SHA1 a6e455f1454bc5f2a2f7c34e6ba0c11f500036cc
- SHA512 36f3b2f2847bb22b02609fb320eb61498ffc4a4145a3ea7069d2aba5811355b1b254398168637120a0e7ec25c9f179c43ef1543dd0daec7ac48d8167a65ddee5
- SSDEEP 6144:jXvDGOtFGIiY5IvPUIx5b1ZSxvPwfbZHON:j/D7FG2yUMJOvPaY
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
neruz
C2
-
193.106.191.27:47242
Attributes
-
auth_value
0169a8759f3c9be473f782b96a6ff704
Targets
-
- Target file.exe
- Size 346KB
- SHA256 8cc7f8c2814caed95fd4dfd859eaa1bcca2771fc7c5111854f20b28de8928a5a
- MD5 0e075bcf9cf63d274fadb5b9b4357e5c
- SHA1 a6e455f1454bc5f2a2f7c34e6ba0c11f500036cc
- SHA512 36f3b2f2847bb22b02609fb320eb61498ffc4a4145a3ea7069d2aba5811355b1b254398168637120a0e7ec25c9f179c43ef1543dd0daec7ac48d8167a65ddee5
- SSDEEP 6144:jXvDGOtFGIiY5IvPUIx5b1ZSxvPwfbZHON:j/D7FG2yUMJOvPaY
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.