General
-
Target
c278cfce93da1486e9fa1e66ba7ddbcb.exe
-
Size
317KB
-
Sample
221124-y698jsgc65
-
MD5
c278cfce93da1486e9fa1e66ba7ddbcb
-
SHA1
b35c919da92548aea8abf26a46fce91e656c1d7a
-
SHA256
6792bd35a4de116b29f3c10fc30e74f28d3437eb58a98def8c037261b104c94a
-
SHA512
ba7ac48b1ad0e9b8fe2147818263e467fddd0b44ea376c635d80ab03c311c55a9ef43ef287f84ff828c530328839bf8489798e2aca173c4826048d07f31d9cad
-
SSDEEP
6144:aq6LJMQFMS3uMlqkIOOrJd8vQssMNtkzmOWkizo/O:aq6VMQmStlqkIOOpMhnhn
Static task
static1
Behavioral task
behavioral1
Sample
c278cfce93da1486e9fa1e66ba7ddbcb.exe
Resource
win7-20220901-en
Malware Config
Extracted
redline
NewYear2023
185.106.92.111:2510
-
auth_value
99e9bde3b38509ea98c3316cc27e6106
Targets
-
-
Target
c278cfce93da1486e9fa1e66ba7ddbcb.exe
-
Size
317KB
-
MD5
c278cfce93da1486e9fa1e66ba7ddbcb
-
SHA1
b35c919da92548aea8abf26a46fce91e656c1d7a
-
SHA256
6792bd35a4de116b29f3c10fc30e74f28d3437eb58a98def8c037261b104c94a
-
SHA512
ba7ac48b1ad0e9b8fe2147818263e467fddd0b44ea376c635d80ab03c311c55a9ef43ef287f84ff828c530328839bf8489798e2aca173c4826048d07f31d9cad
-
SSDEEP
6144:aq6LJMQFMS3uMlqkIOOrJd8vQssMNtkzmOWkizo/O:aq6VMQmStlqkIOOpMhnhn
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-