General
-
Target
aa0965db171fc23eb3b19e3d18deaccb953e8dc9b1362055698c9c886aa5a9a5
-
Size
394KB
-
Sample
230131-mqqcnahg4v
-
MD5
d80a7b49f4d5c6e7a3ddb5e23f4c0d19
-
SHA1
e6e5f7580ec176dc08d881fd030258e52065778a
-
SHA256
aa0965db171fc23eb3b19e3d18deaccb953e8dc9b1362055698c9c886aa5a9a5
-
SHA512
2633efe666ef703cd06c93069969c4a9ebfa30fa77cfe7840e7f6e26de336393a92f4f240a90c5e257edb474bc6ddb1094b339efb5d85484d78b7aa73b8f2ee7
-
SSDEEP
6144:yzgfLRhW5mLjqmVKV0d4Y6mVt5D991T8fUahHN7f4Vf:wM1M5mLjqGKVrY6mdD9zItzO
Static task
static1
Malware Config
Extracted
redline
fredy
62.204.41.170:4132
-
auth_value
880249eef9593d49a1a3cddf57c5cb35
Targets
-
-
Target
aa0965db171fc23eb3b19e3d18deaccb953e8dc9b1362055698c9c886aa5a9a5
-
Size
394KB
-
MD5
d80a7b49f4d5c6e7a3ddb5e23f4c0d19
-
SHA1
e6e5f7580ec176dc08d881fd030258e52065778a
-
SHA256
aa0965db171fc23eb3b19e3d18deaccb953e8dc9b1362055698c9c886aa5a9a5
-
SHA512
2633efe666ef703cd06c93069969c4a9ebfa30fa77cfe7840e7f6e26de336393a92f4f240a90c5e257edb474bc6ddb1094b339efb5d85484d78b7aa73b8f2ee7
-
SSDEEP
6144:yzgfLRhW5mLjqmVKV0d4Y6mVt5D991T8fUahHN7f4Vf:wM1M5mLjqGKVrY6mdD9zItzO
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-