General
-
Target
996ce1e0daa17e56e25b7ec8e8b18dd0f674347ab537c92bbd7e9ae75ee5a16d
-
Size
1.2MB
-
Sample
230223-3d1wmabd2w
-
MD5
3537551f738b8e3714a6e5204a707763
-
SHA1
ada3af325053a4c454e5444ccffcce4bc420fd54
-
SHA256
996ce1e0daa17e56e25b7ec8e8b18dd0f674347ab537c92bbd7e9ae75ee5a16d
-
SHA512
991aa3d962ccc3924e58969dff6dc8e2907b8ff3fa4331cc84fc3022f786e1f4353e7706ad65f104c07607dd0a9088b25464db73ccdb1b645f9efecee132bffd
-
SSDEEP
24576:vfyyuMmPQDOZ12DHO/xexmy9DDpTyahuHM6rYpQVd:vq8m46z4HO/xoDBGakHhr
Static task
static1
Malware Config
Extracted
redline
ronur
193.233.20.20:4134
-
auth_value
f88f86755a528d4b25f6f3628c460965
Extracted
redline
funka
193.233.20.20:4134
-
auth_value
cdb395608d7ec633dce3d2f0c7fb0741
Extracted
amadey
3.67
193.233.20.15/dF30Hn4m/index.php
Extracted
amadey
3.66
62.204.41.88/9vdVVVjsw/index.php
Extracted
redline
Hack
154.17.165.178:10377
-
auth_value
50233687e98ee274b44a32fcc741f9a4
Extracted
amadey
3.65
hellomr.observer/7gjD0Vs3d/index.php
researchersgokick.rocks/7gjD0Vs3d/index.php
pleasetake.pictures/7gjD0Vs3d/index.php
Extracted
redline
Thomas
107.189.165.102:1919
-
auth_value
1a3e158dd21f084bceada6f65fc00a1c
Targets
-
-
Target
996ce1e0daa17e56e25b7ec8e8b18dd0f674347ab537c92bbd7e9ae75ee5a16d
-
Size
1.2MB
-
MD5
3537551f738b8e3714a6e5204a707763
-
SHA1
ada3af325053a4c454e5444ccffcce4bc420fd54
-
SHA256
996ce1e0daa17e56e25b7ec8e8b18dd0f674347ab537c92bbd7e9ae75ee5a16d
-
SHA512
991aa3d962ccc3924e58969dff6dc8e2907b8ff3fa4331cc84fc3022f786e1f4353e7706ad65f104c07607dd0a9088b25464db73ccdb1b645f9efecee132bffd
-
SSDEEP
24576:vfyyuMmPQDOZ12DHO/xexmy9DDpTyahuHM6rYpQVd:vq8m46z4HO/xoDBGakHhr
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-