General
-
Target
20226949c951d0a9168053744db9bba8191e7c083c26820b18fc418c870c10c5
-
Size
1.2MB
-
Sample
230317-v4n1rahc85
-
MD5
9f68f281f92d6f8b49806c738f50e5b8
-
SHA1
debd69998bd15eea36bf108d28b07735a7f27440
-
SHA256
20226949c951d0a9168053744db9bba8191e7c083c26820b18fc418c870c10c5
-
SHA512
09a01fd4a5c0eb473b192e3b2a5a5c05495553863e605c93ee7368a404d41efe94015930ea0de2954a9a01eb55ba010cc50672e53d1319e07c8a10b17673b5d1
-
SSDEEP
24576:f8cZSlf/nIdy4Ta/JYb6qdj3D/ytw8Emuac06l8+sj9H:f8cZSJ+ORYeYDqngTl8+c
Static task
static1
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Extracted
redline
laba
193.233.20.28:4125
-
auth_value
2cf01cffff9092a85ca7e106c547190b
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
20226949c951d0a9168053744db9bba8191e7c083c26820b18fc418c870c10c5
-
Size
1.2MB
-
MD5
9f68f281f92d6f8b49806c738f50e5b8
-
SHA1
debd69998bd15eea36bf108d28b07735a7f27440
-
SHA256
20226949c951d0a9168053744db9bba8191e7c083c26820b18fc418c870c10c5
-
SHA512
09a01fd4a5c0eb473b192e3b2a5a5c05495553863e605c93ee7368a404d41efe94015930ea0de2954a9a01eb55ba010cc50672e53d1319e07c8a10b17673b5d1
-
SSDEEP
24576:f8cZSlf/nIdy4Ta/JYb6qdj3D/ytw8Emuac06l8+sj9H:f8cZSJ+ORYeYDqngTl8+c
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-