General
- Target file.exe
- Size 329KB
- Sample221117-mes96seb63
- SHA256 7df87c244e6bdfe4cc735a792b019ef4e66da4d538fc720a8a94a28219b736e7
- MD5 83ca32af92659cae69d62c8cf1ba7f93
- SHA1 f70bb439f85ecbe126b481b4928f913c73942717
- SHA512 3e0f6f041a85c58ca3e9f016d84d441542c114567027965e36579fa69584d51d3900a4db139e4289afa07d9e55109e74e4776e5d0faed6dbd10dee1e81713496
- SSDEEP 6144:+u36djmSWD5OqLuNMdKQpotF9NSuoUz2VHQwiUc2ZCjT:+71oLuN4tc9CVHelEM
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
neruz
C2
-
193.106.191.27:47242
Attributes
-
auth_value
0169a8759f3c9be473f782b96a6ff704
Targets
-
- Target file.exe
- Size 329KB
- SHA256 7df87c244e6bdfe4cc735a792b019ef4e66da4d538fc720a8a94a28219b736e7
- MD5 83ca32af92659cae69d62c8cf1ba7f93
- SHA1 f70bb439f85ecbe126b481b4928f913c73942717
- SHA512 3e0f6f041a85c58ca3e9f016d84d441542c114567027965e36579fa69584d51d3900a4db139e4289afa07d9e55109e74e4776e5d0faed6dbd10dee1e81713496
- SSDEEP 6144:+u36djmSWD5OqLuNMdKQpotF9NSuoUz2VHQwiUc2ZCjT:+71oLuN4tc9CVHelEM
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.