General
-
Target
3105d0b4696ca1a2d7532c68e0cef3051a4ac8181bf64623fcca1d79d24717cc
-
Size
1.2MB
-
Sample
230318-a6ymraaf56
-
MD5
c7d7417355af460074a55ec670c188d4
-
SHA1
915fd399d9bde3ab85aac3e4a073581f263eded8
-
SHA256
3105d0b4696ca1a2d7532c68e0cef3051a4ac8181bf64623fcca1d79d24717cc
-
SHA512
58a1a306e7d17971aa98a7bb95bfd037e7746af0148d65555e83a919746a34578f9b17e0cc82c1026699a3c58b379b78d345848359d7ceed5352e016243d6ee8
-
SSDEEP
24576:1o+BuoxpUBH8LNgZlSrq/SBxO5ZemkF0ol5LZchOIS:1+oxGBcLNg6q/CxsgRjlncE
Static task
static1
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Extracted
redline
laba
193.233.20.28:4125
-
auth_value
2cf01cffff9092a85ca7e106c547190b
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
3105d0b4696ca1a2d7532c68e0cef3051a4ac8181bf64623fcca1d79d24717cc
-
Size
1.2MB
-
MD5
c7d7417355af460074a55ec670c188d4
-
SHA1
915fd399d9bde3ab85aac3e4a073581f263eded8
-
SHA256
3105d0b4696ca1a2d7532c68e0cef3051a4ac8181bf64623fcca1d79d24717cc
-
SHA512
58a1a306e7d17971aa98a7bb95bfd037e7746af0148d65555e83a919746a34578f9b17e0cc82c1026699a3c58b379b78d345848359d7ceed5352e016243d6ee8
-
SSDEEP
24576:1o+BuoxpUBH8LNgZlSrq/SBxO5ZemkF0ol5LZchOIS:1+oxGBcLNg6q/CxsgRjlncE
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-