General
-
Target
a856e3727ae2717c575485795a755787870fddf949915e819de7dfb56745327a
-
Size
278KB
-
Sample
230130-xrhz3sbg94
-
MD5
e2d5d4eb37244b06bdc4087e3a63d592
-
SHA1
7d622ccebd25037edc92c87f49cae269688d32d3
-
SHA256
a856e3727ae2717c575485795a755787870fddf949915e819de7dfb56745327a
-
SHA512
e204ca8882114b92d8ec846f6153811a6c1917f0ea1f649af330222221daabfe21589222cb79e162ba283614725493d68abb028e2469baf213fe0efcc65bc8c9
-
SSDEEP
6144:haLkKT1XpNvnRfbh0JKSkHqfmi7JDr9NvQrrY:hagKT1Xnb/qeiJDr9pQrU
Static task
static1
Malware Config
Extracted
redline
fredy
62.204.41.170:4132
-
auth_value
880249eef9593d49a1a3cddf57c5cb35
Targets
-
-
Target
a856e3727ae2717c575485795a755787870fddf949915e819de7dfb56745327a
-
Size
278KB
-
MD5
e2d5d4eb37244b06bdc4087e3a63d592
-
SHA1
7d622ccebd25037edc92c87f49cae269688d32d3
-
SHA256
a856e3727ae2717c575485795a755787870fddf949915e819de7dfb56745327a
-
SHA512
e204ca8882114b92d8ec846f6153811a6c1917f0ea1f649af330222221daabfe21589222cb79e162ba283614725493d68abb028e2469baf213fe0efcc65bc8c9
-
SSDEEP
6144:haLkKT1XpNvnRfbh0JKSkHqfmi7JDr9NvQrrY:hagKT1Xnb/qeiJDr9pQrU
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-