General
- Target file.exe
- Size 346KB
- Sample221115-ys9pvsff46
- SHA256 62b28bb06ad64ea6d5a5fd217dab72aeb192caf6a9fe11291d3a4e4c10b38585
- MD5 d77ad1e03c634f0bb96ffe2a83fc348b
- SHA1 e7fb4b43402aa0921403ac7835e9bafa0ca1b0a3
- SHA512 33e23f7166d85cfc55fb0b615ef3d867080203f29396ec5c92429f19980dd2648f895ec2c39635e87b54dfaead7e7293c3807c510f0cc5431e3dc85ef62bf14f
- SSDEEP 6144:QVXe2moFhLEFf8d8cB6A+XGFaideRcgKtyVNQ:QVrFFEA8cB+Saidev
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
neruz
C2
-
193.106.191.27:47242
Attributes
-
auth_value
0169a8759f3c9be473f782b96a6ff704
Targets
-
- Target file.exe
- Size 346KB
- SHA256 62b28bb06ad64ea6d5a5fd217dab72aeb192caf6a9fe11291d3a4e4c10b38585
- MD5 d77ad1e03c634f0bb96ffe2a83fc348b
- SHA1 e7fb4b43402aa0921403ac7835e9bafa0ca1b0a3
- SHA512 33e23f7166d85cfc55fb0b615ef3d867080203f29396ec5c92429f19980dd2648f895ec2c39635e87b54dfaead7e7293c3807c510f0cc5431e3dc85ef62bf14f
- SSDEEP 6144:QVXe2moFhLEFf8d8cB6A+XGFaideRcgKtyVNQ:QVrFFEA8cB+Saidev
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.