General
-
Target
4a8248de1ec4189b7c84cc52fc712c1d8e364197bb048ac42b75a564b5d58fe0
-
Size
764KB
-
Sample
230209-szekeahh96
-
MD5
58dc9b88868c396c738d14550f5bb8d0
-
SHA1
7568ab17d63c449b9c7f4f2f6fbc4bd0c2e0a38a
-
SHA256
4a8248de1ec4189b7c84cc52fc712c1d8e364197bb048ac42b75a564b5d58fe0
-
SHA512
957bc61aa153cc06d44ab6bc6503b34bd70c9e2dfa579c1a839dc0663483a997dbdb30a5983bfa5f185ef893e72c284dec84ef5ac88cf5e759bc7c86154d25d0
-
SSDEEP
12288:PMrry908ycA0s+cSmg8wgkxSUQVd53NrNeWTCwvpLRnxUPdQhbjOa2a9+sSuhoD:YyI0s+czUVxSZBNrNdlLRxU+hbjO/a9c
Static task
static1
Malware Config
Extracted
redline
dubna
193.233.20.11:4131
-
auth_value
f324b1269094b7462e56bab025f032f4
Extracted
redline
romka
193.233.20.11:4131
-
auth_value
fcbb3247051f5290e8ac5b1a841af67b
Extracted
redline
crypt
176.113.115.17:4132
-
auth_value
407e05c9b3a74d99a20f90b091547bd6
Targets
-
-
Target
4a8248de1ec4189b7c84cc52fc712c1d8e364197bb048ac42b75a564b5d58fe0
-
Size
764KB
-
MD5
58dc9b88868c396c738d14550f5bb8d0
-
SHA1
7568ab17d63c449b9c7f4f2f6fbc4bd0c2e0a38a
-
SHA256
4a8248de1ec4189b7c84cc52fc712c1d8e364197bb048ac42b75a564b5d58fe0
-
SHA512
957bc61aa153cc06d44ab6bc6503b34bd70c9e2dfa579c1a839dc0663483a997dbdb30a5983bfa5f185ef893e72c284dec84ef5ac88cf5e759bc7c86154d25d0
-
SSDEEP
12288:PMrry908ycA0s+cSmg8wgkxSUQVd53NrNeWTCwvpLRnxUPdQhbjOa2a9+sSuhoD:YyI0s+czUVxSZBNrNdlLRxU+hbjO/a9c
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-