General
-
Target
8be2b6aa6526c28ab2c3cc65b7b72ee12cd3b4e45983cd287613fa6d80841e09
-
Size
339KB
-
Sample
230203-hs2fgscc69
-
MD5
c88b9952ed9bd1f7314df554e4794de0
-
SHA1
5e0207ce1c91bf3ad288735717074cfc6ae24115
-
SHA256
8be2b6aa6526c28ab2c3cc65b7b72ee12cd3b4e45983cd287613fa6d80841e09
-
SHA512
52dccab17576fb53701680b99911fb69eb249833e84524d76060ba1f8be908e13474352c0d72ff2a7f820ca237811bac08fc95b77da2d20ca0649adb95f8a457
-
SSDEEP
6144:nbDQmioYCCAYp5fRZOVANlZ1iJ5ZccG7uMR9NX23BoIgPEDZCO4lw1JedPlC:nbDQ7LpDcVAN1lDm3BoIgPEDZCO4lw1H
Malware Config
Extracted
redline
24.01
37.220.86.164:29170
-
auth_value
1c7f0aa21138601b5201a3a4a0123991
Targets
-
-
Target
8be2b6aa6526c28ab2c3cc65b7b72ee12cd3b4e45983cd287613fa6d80841e09
-
Size
339KB
-
MD5
c88b9952ed9bd1f7314df554e4794de0
-
SHA1
5e0207ce1c91bf3ad288735717074cfc6ae24115
-
SHA256
8be2b6aa6526c28ab2c3cc65b7b72ee12cd3b4e45983cd287613fa6d80841e09
-
SHA512
52dccab17576fb53701680b99911fb69eb249833e84524d76060ba1f8be908e13474352c0d72ff2a7f820ca237811bac08fc95b77da2d20ca0649adb95f8a457
-
SSDEEP
6144:nbDQmioYCCAYp5fRZOVANlZ1iJ5ZccG7uMR9NX23BoIgPEDZCO4lw1JedPlC:nbDQ7LpDcVAN1lDm3BoIgPEDZCO4lw1H
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-