General
-
Target
b25276475053e1d4abdb00ae75ac931bd554cd508d17d54733f39643c4c697cb
-
Size
425KB
-
Sample
230206-17n3tagb54
-
MD5
f86787ba86aa322039944d084648a82d
-
SHA1
b0017ebba5fba650bda154a7866ca570c7bb015f
-
SHA256
b25276475053e1d4abdb00ae75ac931bd554cd508d17d54733f39643c4c697cb
-
SHA512
220a941d78b86a9c8ce0b48419333889bb2745d6d4dc646097a0814937c4b3030920b6c8a97e20343e1f410438c76d10be3f9f9362395377102f03ca987f74c7
-
SSDEEP
6144:N5LSUJ0cZIVpMu0ewHSIZz0OjFVzXxzucaW7W9mp94Xv7uk6oVjM:N5GUJckuySCzdjFVt4GpWTru
Static task
static1
Behavioral task
behavioral1
Sample
b25276475053e1d4abdb00ae75ac931bd554cd508d17d54733f39643c4c697cb.exe
Resource
win7-20221111-en
Malware Config
Extracted
redline
1C
198.244.249.186:21458
-
auth_value
43d665a8a4c34b128f37125fd19d766e
Targets
-
-
Target
b25276475053e1d4abdb00ae75ac931bd554cd508d17d54733f39643c4c697cb
-
Size
425KB
-
MD5
f86787ba86aa322039944d084648a82d
-
SHA1
b0017ebba5fba650bda154a7866ca570c7bb015f
-
SHA256
b25276475053e1d4abdb00ae75ac931bd554cd508d17d54733f39643c4c697cb
-
SHA512
220a941d78b86a9c8ce0b48419333889bb2745d6d4dc646097a0814937c4b3030920b6c8a97e20343e1f410438c76d10be3f9f9362395377102f03ca987f74c7
-
SSDEEP
6144:N5LSUJ0cZIVpMu0ewHSIZz0OjFVzXxzucaW7W9mp94Xv7uk6oVjM:N5GUJckuySCzdjFVt4GpWTru
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-