General
-
Target
24bd8119119ae6f37cf1a8849e948978f8974e8e051e6cac9faaeb4699da7ec3
-
Size
689KB
-
Sample
230318-d8wsqabb28
-
MD5
16421b2f6ed14099e829749b60f4c7ad
-
SHA1
99979d4a210900f8324f361c39422713658ab67d
-
SHA256
24bd8119119ae6f37cf1a8849e948978f8974e8e051e6cac9faaeb4699da7ec3
-
SHA512
d7926b5a322569c7415d2d7b5f3daad2f85096e56592d433ef7abc4adcdcc5cdf9e9cd5edd5aa840ccff03b00cf015dc801c62c44681612b6f0c97f83ef9633e
-
SSDEEP
12288:DMrsy90lPOvo+81oXCm4FHfCt8CcUZA6Rg+iAnRkxE5LMBeVPcQDXSBKl:fyo+781oXCm4VfCtcUZAB+iF7Q+BS
Static task
static1
Malware Config
Extracted
redline
lint
193.233.20.28:4125
-
auth_value
0e95262fb78243c67430f3148303e5b7
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Extracted
redline
Redline
85.31.54.181:43728
-
auth_value
1666a0a46296c430de7ba5e70bd0c0f3
Targets
-
-
Target
24bd8119119ae6f37cf1a8849e948978f8974e8e051e6cac9faaeb4699da7ec3
-
Size
689KB
-
MD5
16421b2f6ed14099e829749b60f4c7ad
-
SHA1
99979d4a210900f8324f361c39422713658ab67d
-
SHA256
24bd8119119ae6f37cf1a8849e948978f8974e8e051e6cac9faaeb4699da7ec3
-
SHA512
d7926b5a322569c7415d2d7b5f3daad2f85096e56592d433ef7abc4adcdcc5cdf9e9cd5edd5aa840ccff03b00cf015dc801c62c44681612b6f0c97f83ef9633e
-
SSDEEP
12288:DMrsy90lPOvo+81oXCm4FHfCt8CcUZA6Rg+iAnRkxE5LMBeVPcQDXSBKl:fyo+781oXCm4VfCtcUZAB+iF7Q+BS
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-