General
- Target file.exe
- Size 481KB
- Sample221118-rht34add7s
- SHA256 de53065c8fe0e17ab1b9875ad9d4bbefdf3ee2f749326bc5793f2da509f17da5
- MD5 16fce4c5fa9ef2437c1a9c6059e769c1
- SHA1 1c8469238dd3521174165cc5f654ad5022534853
- SHA512 5cd1a32db50828c11133006f826fa23e896f3b3b6cfa652924b7010cf35bb4ea434036dc429cf209e5476c2d071e4a7884923f0c7e38527e6fe9584fcdc90a97
- SSDEEP 12288:vR7EV0Cr84azOwBA48nkPZVXhp0fQ1jw:vRgVhrTaMWpLj1k
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
dozkey
C2
-
193.106.191.30:47242
Attributes
-
auth_value
6386fb6f33ca338f864abfc5f8fe1774
Targets
-
- Target file.exe
- Size 481KB
- SHA256 de53065c8fe0e17ab1b9875ad9d4bbefdf3ee2f749326bc5793f2da509f17da5
- MD5 16fce4c5fa9ef2437c1a9c6059e769c1
- SHA1 1c8469238dd3521174165cc5f654ad5022534853
- SHA512 5cd1a32db50828c11133006f826fa23e896f3b3b6cfa652924b7010cf35bb4ea434036dc429cf209e5476c2d071e4a7884923f0c7e38527e6fe9584fcdc90a97
- SSDEEP 12288:vR7EV0Cr84azOwBA48nkPZVXhp0fQ1jw:vRgVhrTaMWpLj1k
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.