General
-
Target
4a6a1ebfe0c8e665e934181a390dc8eac12b7b453c6448a4476c74b862d68474
-
Size
395KB
-
Sample
230131-ldn4dshe8s
-
MD5
0e9f9e452218992b5c6f8d4afa418962
-
SHA1
3e12807f42e403a19ecc3c6c0df71c46b2df22a4
-
SHA256
4a6a1ebfe0c8e665e934181a390dc8eac12b7b453c6448a4476c74b862d68474
-
SHA512
c4b799a0db04f34a413572174b1839bd86dbe60072d01f9d34e96e0fa741e88d3ce296289b2d8616e2ae8d2b7007b5b3db002cc0068192bc58909a4bff9318ef
-
SSDEEP
6144:3cGj4L0WiNMLxoXFwT2Xo7pp7HwmQ3N3rsIJzJgfFRRGf7f4V4:r8AixOmj1Q3ZZisfzO
Static task
static1
Malware Config
Extracted
redline
fredy
62.204.41.170:4132
-
auth_value
880249eef9593d49a1a3cddf57c5cb35
Targets
-
-
Target
4a6a1ebfe0c8e665e934181a390dc8eac12b7b453c6448a4476c74b862d68474
-
Size
395KB
-
MD5
0e9f9e452218992b5c6f8d4afa418962
-
SHA1
3e12807f42e403a19ecc3c6c0df71c46b2df22a4
-
SHA256
4a6a1ebfe0c8e665e934181a390dc8eac12b7b453c6448a4476c74b862d68474
-
SHA512
c4b799a0db04f34a413572174b1839bd86dbe60072d01f9d34e96e0fa741e88d3ce296289b2d8616e2ae8d2b7007b5b3db002cc0068192bc58909a4bff9318ef
-
SSDEEP
6144:3cGj4L0WiNMLxoXFwT2Xo7pp7HwmQ3N3rsIJzJgfFRRGf7f4V4:r8AixOmj1Q3ZZisfzO
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-