General
-
Target
e8221f7d7a2eb1473b1825f98e1727ff679c62c7bd3e5c8311b3973ca948cad0
-
Size
689KB
-
Sample
230318-ghggwsbd73
-
MD5
c5a273e335d3f3bc087f9ef24a2b05b2
-
SHA1
8789ad58f80975dbede833a2301ab523052cefb3
-
SHA256
e8221f7d7a2eb1473b1825f98e1727ff679c62c7bd3e5c8311b3973ca948cad0
-
SHA512
e514a8f3153d167e317e0d70de1207055c5911448c88e9af852929cf81ad27265d1ec07b7e211dd243cde39fc95d4f014ae54f9d25776b05bd26f5074f5a604e
-
SSDEEP
12288:dMr3y90Eg/bZ84qDKrVEuESCL2DxPQYiO3vGxAva4usJCAJg:ayja0GBEuRCEGYvfGxAva4NCh
Static task
static1
Malware Config
Extracted
redline
lint
193.233.20.28:4125
-
auth_value
0e95262fb78243c67430f3148303e5b7
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Extracted
redline
Redline
85.31.54.181:43728
-
auth_value
1666a0a46296c430de7ba5e70bd0c0f3
Targets
-
-
Target
e8221f7d7a2eb1473b1825f98e1727ff679c62c7bd3e5c8311b3973ca948cad0
-
Size
689KB
-
MD5
c5a273e335d3f3bc087f9ef24a2b05b2
-
SHA1
8789ad58f80975dbede833a2301ab523052cefb3
-
SHA256
e8221f7d7a2eb1473b1825f98e1727ff679c62c7bd3e5c8311b3973ca948cad0
-
SHA512
e514a8f3153d167e317e0d70de1207055c5911448c88e9af852929cf81ad27265d1ec07b7e211dd243cde39fc95d4f014ae54f9d25776b05bd26f5074f5a604e
-
SSDEEP
12288:dMr3y90Eg/bZ84qDKrVEuESCL2DxPQYiO3vGxAva4usJCAJg:ayja0GBEuRCEGYvfGxAva4NCh
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-