General
-
Target
156a05a3d8289d6064e12810eda73da7687515a2c27e7a72e177bc66b5a7203c
-
Size
688KB
-
Sample
230318-cfrsmaah28
-
MD5
748d9a2c7a3dffea95aaae102295bc70
-
SHA1
2df54b446cd31535d80a309b63363d16247f382c
-
SHA256
156a05a3d8289d6064e12810eda73da7687515a2c27e7a72e177bc66b5a7203c
-
SHA512
ceb41a5fc5dd2722791b45f4aa37206c01a34a5609a501822403ff828da488b597d280c3b23174fa4f90716f314d23fb28c020e592bc4bb3ec1d18b3bb147e71
-
SSDEEP
12288:mMrFy90EgM1xiONkYWIEQuwbMxkYSeBAwrR/VC43gao0yOVWPuWFwZQC1rA/Kox5:Hytzj8YOK4TjAaR/VC4+0yeWByA/K45
Static task
static1
Behavioral task
behavioral1
Sample
156a05a3d8289d6064e12810eda73da7687515a2c27e7a72e177bc66b5a7203c.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
lint
193.233.20.28:4125
-
auth_value
0e95262fb78243c67430f3148303e5b7
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Targets
-
-
Target
156a05a3d8289d6064e12810eda73da7687515a2c27e7a72e177bc66b5a7203c
-
Size
688KB
-
MD5
748d9a2c7a3dffea95aaae102295bc70
-
SHA1
2df54b446cd31535d80a309b63363d16247f382c
-
SHA256
156a05a3d8289d6064e12810eda73da7687515a2c27e7a72e177bc66b5a7203c
-
SHA512
ceb41a5fc5dd2722791b45f4aa37206c01a34a5609a501822403ff828da488b597d280c3b23174fa4f90716f314d23fb28c020e592bc4bb3ec1d18b3bb147e71
-
SSDEEP
12288:mMrFy90EgM1xiONkYWIEQuwbMxkYSeBAwrR/VC43gao0yOVWPuWFwZQC1rA/Kox5:Hytzj8YOK4TjAaR/VC4+0yeWByA/K45
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-