General
-
Target
51a09ca77eba76573656b04018a27c58b3436981d44522c44642f41bfd496c60
-
Size
689KB
-
Sample
230318-dk7kbada7s
-
MD5
a8219ec27bf738e2f014ddbefbf06a1c
-
SHA1
7954596ce6a6a627921a18f9844ddcdfe171f1a6
-
SHA256
51a09ca77eba76573656b04018a27c58b3436981d44522c44642f41bfd496c60
-
SHA512
900cb6d43cd36deafbd9b381d8500d96136e15204b3529e7b1704717e81189c841a15528b3345473c9ea2bf29935efab2b46287c0fd127062650988dddb22033
-
SSDEEP
12288:zMr0y90JZHzaFACDoqVP6H0HadxVCNJEkiIfmuDZOUjt3LrvQ1wYvF5T0+:XyCzaFACMqdIyadxA8kiVlUj1n8wYvf
Static task
static1
Behavioral task
behavioral1
Sample
51a09ca77eba76573656b04018a27c58b3436981d44522c44642f41bfd496c60.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
lint
193.233.20.28:4125
-
auth_value
0e95262fb78243c67430f3148303e5b7
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Targets
-
-
Target
51a09ca77eba76573656b04018a27c58b3436981d44522c44642f41bfd496c60
-
Size
689KB
-
MD5
a8219ec27bf738e2f014ddbefbf06a1c
-
SHA1
7954596ce6a6a627921a18f9844ddcdfe171f1a6
-
SHA256
51a09ca77eba76573656b04018a27c58b3436981d44522c44642f41bfd496c60
-
SHA512
900cb6d43cd36deafbd9b381d8500d96136e15204b3529e7b1704717e81189c841a15528b3345473c9ea2bf29935efab2b46287c0fd127062650988dddb22033
-
SSDEEP
12288:zMr0y90JZHzaFACDoqVP6H0HadxVCNJEkiIfmuDZOUjt3LrvQ1wYvF5T0+:XyCzaFACMqdIyadxA8kiVlUj1n8wYvf
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-