General
-
Target
c858f08a74d5281a746605ca7b5fb748db67b99ed92230da66731e8245201701
-
Size
1.2MB
-
Sample
230224-dpby7sca4z
-
MD5
d436734ad4f3e589c54383676c120693
-
SHA1
3b47510d665e72bb0d773356fcb10f58fbb35aa7
-
SHA256
c858f08a74d5281a746605ca7b5fb748db67b99ed92230da66731e8245201701
-
SHA512
e13f86182cc06d8bf6ffb8dffd7d7e64481a8b9f62069f43e9d29878ec6ce1aa10ef704a70ee080da579d704ce68bde2fe1c3d2a6dbf139352955445155503eb
-
SSDEEP
24576:4yhuz/M82njTLwTxrCehaI8jkqghrsLxxc5WGrmp1jepzqDIs7t9NHk:/hv8OjvwTVdjJqgxslxcq1jept6t9
Static task
static1
Malware Config
Extracted
redline
ronur
193.233.20.20:4134
-
auth_value
f88f86755a528d4b25f6f3628c460965
Extracted
redline
funka
193.233.20.20:4134
-
auth_value
cdb395608d7ec633dce3d2f0c7fb0741
Extracted
amadey
3.67
193.233.20.15/dF30Hn4m/index.php
specialblue.in/dF30Hn4m/index.php
specialblue.pm/dF30Hn4m/index.php
specialblue.wf/dF30Hn4m/index.php
Extracted
amadey
3.66
62.204.41.88/9vdVVVjsw/index.php
Extracted
amadey
3.65
hellomr.observer/7gjD0Vs3d/index.php
researchersgokick.rocks/7gjD0Vs3d/index.php
pleasetake.pictures/7gjD0Vs3d/index.php
Extracted
redline
Hack
154.17.165.178:10377
-
auth_value
50233687e98ee274b44a32fcc741f9a4
Extracted
aurora
212.87.204.93:8081
Targets
-
-
Target
c858f08a74d5281a746605ca7b5fb748db67b99ed92230da66731e8245201701
-
Size
1.2MB
-
MD5
d436734ad4f3e589c54383676c120693
-
SHA1
3b47510d665e72bb0d773356fcb10f58fbb35aa7
-
SHA256
c858f08a74d5281a746605ca7b5fb748db67b99ed92230da66731e8245201701
-
SHA512
e13f86182cc06d8bf6ffb8dffd7d7e64481a8b9f62069f43e9d29878ec6ce1aa10ef704a70ee080da579d704ce68bde2fe1c3d2a6dbf139352955445155503eb
-
SSDEEP
24576:4yhuz/M82njTLwTxrCehaI8jkqghrsLxxc5WGrmp1jepzqDIs7t9NHk:/hv8OjvwTVdjJqgxslxcq1jept6t9
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-