General
-
Target
fe15497017dc63e9269f97c70e87b186ddb45271a98cc3b8f4483be5ea34434e
-
Size
690KB
-
Sample
230318-j37wpabf67
-
MD5
9e9827039f814343d92d08331581dc0d
-
SHA1
cfccadd9e8d5562530330db859773c8a4df1bfac
-
SHA256
fe15497017dc63e9269f97c70e87b186ddb45271a98cc3b8f4483be5ea34434e
-
SHA512
8aefa254e2f7f03be0f7b5ed92b85ac138070a36c042be281b96af3e3ffa816e3c28eafcc99387d23ff7881842dd39d6dc86e20c7496f0195d117894c3b0d4bc
-
SSDEEP
12288:sMrZy90gypINrdnJEyo+fVa1sD2UAqRmn4ZQBvysyi0Obi4WZg9:9yxypOrVJEb+fVWUAqRmtv5Rhig9
Static task
static1
Behavioral task
behavioral1
Sample
fe15497017dc63e9269f97c70e87b186ddb45271a98cc3b8f4483be5ea34434e.exe
Resource
win10-20230220-en
Malware Config
Extracted
redline
lint
193.233.20.28:4125
-
auth_value
0e95262fb78243c67430f3148303e5b7
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Targets
-
-
Target
fe15497017dc63e9269f97c70e87b186ddb45271a98cc3b8f4483be5ea34434e
-
Size
690KB
-
MD5
9e9827039f814343d92d08331581dc0d
-
SHA1
cfccadd9e8d5562530330db859773c8a4df1bfac
-
SHA256
fe15497017dc63e9269f97c70e87b186ddb45271a98cc3b8f4483be5ea34434e
-
SHA512
8aefa254e2f7f03be0f7b5ed92b85ac138070a36c042be281b96af3e3ffa816e3c28eafcc99387d23ff7881842dd39d6dc86e20c7496f0195d117894c3b0d4bc
-
SSDEEP
12288:sMrZy90gypINrdnJEyo+fVa1sD2UAqRmn4ZQBvysyi0Obi4WZg9:9yxypOrVJEb+fVWUAqRmtv5Rhig9
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-