General
-
Target
470b0e22250e3d5c7244fb4617b3a164.exe
-
Size
298KB
-
Sample
230301-rbh29aga3v
-
MD5
470b0e22250e3d5c7244fb4617b3a164
-
SHA1
e8a57bbd7e70dc9f8d5c0dfb7326d7d476f19582
-
SHA256
948a2a18460d7282a8079f762a0de2e61cbfef340f2e48ad71d7290c31f86afa
-
SHA512
b1147a3bd003a55c3271be2c389fb6fdc81a9c33b0f9003945337d0179049821ec1df8cd494bdd2e6f1645aff186fefe3ba08a39a7288fa08c6b652eb612585d
-
SSDEEP
6144:+DarbxchBjZToreADsq+5EJkR4PQcY46CfZn06NZnj29jma:+Dar6njZTMPAX5EKR4Icz6Gn06NZnj2I
Malware Config
Targets
-
-
Target
470b0e22250e3d5c7244fb4617b3a164.exe
-
Size
298KB
-
MD5
470b0e22250e3d5c7244fb4617b3a164
-
SHA1
e8a57bbd7e70dc9f8d5c0dfb7326d7d476f19582
-
SHA256
948a2a18460d7282a8079f762a0de2e61cbfef340f2e48ad71d7290c31f86afa
-
SHA512
b1147a3bd003a55c3271be2c389fb6fdc81a9c33b0f9003945337d0179049821ec1df8cd494bdd2e6f1645aff186fefe3ba08a39a7288fa08c6b652eb612585d
-
SSDEEP
6144:+DarbxchBjZToreADsq+5EJkR4PQcY46CfZn06NZnj29jma:+Dar6njZTMPAX5EKR4Icz6Gn06NZnj2I
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-