General
-
Target
88d3499cead87b31185f357238ed3f97e499ab28c7d7eceaaa39f9bddbe3ffc5
-
Size
1.2MB
-
Sample
230317-wbh5gahd39
-
MD5
3d0bd8c7fe7846aa4f6551a787af01bc
-
SHA1
725987c8a650f0f65cef86f9ce7850f872349d22
-
SHA256
88d3499cead87b31185f357238ed3f97e499ab28c7d7eceaaa39f9bddbe3ffc5
-
SHA512
0982177b25762817bde34e362f16cb4f19685d57cd2441faf220c85fd7aae8db34a6f89aae59784fb6887dcaa9dae6a286062400e9b81ce3c5e3caa33ee11f81
-
SSDEEP
24576:J8cZSlf/nIdy4Ta/JYb6qdj3D/ytw8Emuac06l8+sj9H:J8cZSJ+ORYeYDqngTl8+c
Static task
static1
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Extracted
redline
laba
193.233.20.28:4125
-
auth_value
2cf01cffff9092a85ca7e106c547190b
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
88d3499cead87b31185f357238ed3f97e499ab28c7d7eceaaa39f9bddbe3ffc5
-
Size
1.2MB
-
MD5
3d0bd8c7fe7846aa4f6551a787af01bc
-
SHA1
725987c8a650f0f65cef86f9ce7850f872349d22
-
SHA256
88d3499cead87b31185f357238ed3f97e499ab28c7d7eceaaa39f9bddbe3ffc5
-
SHA512
0982177b25762817bde34e362f16cb4f19685d57cd2441faf220c85fd7aae8db34a6f89aae59784fb6887dcaa9dae6a286062400e9b81ce3c5e3caa33ee11f81
-
SSDEEP
24576:J8cZSlf/nIdy4Ta/JYb6qdj3D/ytw8Emuac06l8+sj9H:J8cZSJ+ORYeYDqngTl8+c
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-