General
-
Target
f5bb516420f9ab6cfe70a9ba29a814732ac523a06def8d92225305a29e54ad1d
-
Size
1.2MB
-
Sample
230318-hs3njsdf3y
-
MD5
98f38265c19dcea6bf7dd69193c8838b
-
SHA1
6d83ae9a7e62d61270c6704202575c7f59238083
-
SHA256
f5bb516420f9ab6cfe70a9ba29a814732ac523a06def8d92225305a29e54ad1d
-
SHA512
346931f849a4ad1757594748945b5a296d7721759c1e7dafc82d0d9594a56e1363fa220e5b7b2f19fc3c17e0b79123756a6235d1b14387ff4f07553b17f6bbda
-
SSDEEP
24576:A3fA/X9x8NfB7bCvJpAaUQMz5itmXaZH/BV:AISfBnyXAPFQis
Static task
static1
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Extracted
redline
laba
193.233.20.28:4125
-
auth_value
2cf01cffff9092a85ca7e106c547190b
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
f5bb516420f9ab6cfe70a9ba29a814732ac523a06def8d92225305a29e54ad1d
-
Size
1.2MB
-
MD5
98f38265c19dcea6bf7dd69193c8838b
-
SHA1
6d83ae9a7e62d61270c6704202575c7f59238083
-
SHA256
f5bb516420f9ab6cfe70a9ba29a814732ac523a06def8d92225305a29e54ad1d
-
SHA512
346931f849a4ad1757594748945b5a296d7721759c1e7dafc82d0d9594a56e1363fa220e5b7b2f19fc3c17e0b79123756a6235d1b14387ff4f07553b17f6bbda
-
SSDEEP
24576:A3fA/X9x8NfB7bCvJpAaUQMz5itmXaZH/BV:AISfBnyXAPFQis
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-