General
-
Target
375b3f0fce3cfb5354989de52287595b422519d087ffddb0bd5f1b438d4c7dd4
-
Size
244KB
-
Sample
221123-hybf9aaa9x
-
MD5
d798d2c741c4d86654a75b09128107f3
-
SHA1
b3b96e3f35de95a77cbb575b593aebab92f45f4d
-
SHA256
375b3f0fce3cfb5354989de52287595b422519d087ffddb0bd5f1b438d4c7dd4
-
SHA512
f1f6b67a784e9f8f16d2c8132eb55900e8cfd931926fd8b765ffc0f8bb4dc7acb223a38490ded588eadbb6bd9e985663fa3cc864755fa6cbf5fb5f385b3fed9f
-
SSDEEP
3072:FBIEuN9oWC0kPLZJnjPWfZD5S6u5MIRz8a6uUtJU/m5i0tHwcL/SX4M8nqHr:0EY66+LZNz0yMnaSa/m7tHLzSX4XqL
Static task
static1
Behavioral task
behavioral1
Sample
375b3f0fce3cfb5354989de52287595b422519d087ffddb0bd5f1b438d4c7dd4.exe
Resource
win10-20220812-en
Malware Config
Extracted
amadey
3.50
193.56.146.174/g84kvj4jck/index.php
Extracted
redline
novr
31.41.244.14:4694
-
auth_value
34ddf4eb9326256f20a48cd5f1e9b496
Targets
-
-
Target
375b3f0fce3cfb5354989de52287595b422519d087ffddb0bd5f1b438d4c7dd4
-
Size
244KB
-
MD5
d798d2c741c4d86654a75b09128107f3
-
SHA1
b3b96e3f35de95a77cbb575b593aebab92f45f4d
-
SHA256
375b3f0fce3cfb5354989de52287595b422519d087ffddb0bd5f1b438d4c7dd4
-
SHA512
f1f6b67a784e9f8f16d2c8132eb55900e8cfd931926fd8b765ffc0f8bb4dc7acb223a38490ded588eadbb6bd9e985663fa3cc864755fa6cbf5fb5f385b3fed9f
-
SSDEEP
3072:FBIEuN9oWC0kPLZJnjPWfZD5S6u5MIRz8a6uUtJU/m5i0tHwcL/SX4M8nqHr:0EY66+LZNz0yMnaSa/m7tHLzSX4XqL
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-