General
-
Target
file.exe
-
Size
364KB
-
Sample
221116-slq2aafg6v
-
MD5
f922080d9d3eec08b94a39ae34641064
-
SHA1
9fda60e79c7dd500a89045686800b5ba303aed47
-
SHA256
68f8fc9275abfb5bb861728c49fcc24111af0bb63c20d9e405c8692b8a3fbb42
-
SHA512
c1686313ecbd01c7489be5bedb15a47a19169eed6f049b8ee93ecd585247e14dc97e5352fa1059917036acc5acdea36fdf14d6eee939baaa2ce9a44a98c4c1d7
-
SSDEEP
6144:9MCLskKw05BvWfs+KF/7IsTPUhy8Mz7GN8yO15d4TvUV8g6vBvhypqW:9F4a05th8aUI8Mz6eyO15KTQ8goB5yp
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
Malware Config
Extracted
redline
neruz
193.106.191.27:47242
-
auth_value
0169a8759f3c9be473f782b96a6ff704
Targets
-
-
Target
file.exe
-
Size
364KB
-
MD5
f922080d9d3eec08b94a39ae34641064
-
SHA1
9fda60e79c7dd500a89045686800b5ba303aed47
-
SHA256
68f8fc9275abfb5bb861728c49fcc24111af0bb63c20d9e405c8692b8a3fbb42
-
SHA512
c1686313ecbd01c7489be5bedb15a47a19169eed6f049b8ee93ecd585247e14dc97e5352fa1059917036acc5acdea36fdf14d6eee939baaa2ce9a44a98c4c1d7
-
SSDEEP
6144:9MCLskKw05BvWfs+KF/7IsTPUhy8Mz7GN8yO15d4TvUV8g6vBvhypqW:9F4a05th8aUI8Mz6eyO15KTQ8goB5yp
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-