General
-
Target
91aa4b474ed6239b658d3c0e519524b7ec2cb54619deeeafbf9630f01a177256
-
Size
1.3MB
-
Sample
230301-3tx5nsaf84
-
MD5
44a187363b948f21280faf05e7b3a41e
-
SHA1
5632c9adbd1e934f22228aeddefa6780b3500fb5
-
SHA256
91aa4b474ed6239b658d3c0e519524b7ec2cb54619deeeafbf9630f01a177256
-
SHA512
795c02f97a23154f1597db900b1d448512521d6de0db9fbfa97268e8e02fdde29cda491976dd7b2293afba631fddaea717d74232bbccec074cdfbfc657a9bfdf
-
SSDEEP
24576:+y9oVXwVjwcj2US5n9MIIX0oKFFQwgHPnK3+BfBmyAa0cMGKL9xuUxGrZ1:N9yXwJBjVIIXlKjQRvK3+BfSctkvw
Static task
static1
Malware Config
Extracted
redline
rouch
193.56.146.11:4162
-
auth_value
1b1735bcfc122c708eae27ca352568de
Extracted
amadey
3.67
193.233.20.14/BR54nmB3/index.php
Extracted
redline
fuba
193.56.146.11:4162
-
auth_value
43015841fc23c63b15ca6ffe1d278d5e
Targets
-
-
Target
91aa4b474ed6239b658d3c0e519524b7ec2cb54619deeeafbf9630f01a177256
-
Size
1.3MB
-
MD5
44a187363b948f21280faf05e7b3a41e
-
SHA1
5632c9adbd1e934f22228aeddefa6780b3500fb5
-
SHA256
91aa4b474ed6239b658d3c0e519524b7ec2cb54619deeeafbf9630f01a177256
-
SHA512
795c02f97a23154f1597db900b1d448512521d6de0db9fbfa97268e8e02fdde29cda491976dd7b2293afba631fddaea717d74232bbccec074cdfbfc657a9bfdf
-
SSDEEP
24576:+y9oVXwVjwcj2US5n9MIIX0oKFFQwgHPnK3+BfBmyAa0cMGKL9xuUxGrZ1:N9yXwJBjVIIXlKjQRvK3+BfSctkvw
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-