General
-
Target
1f4069228ad65edd78f52961421c978d089dbfe9cf318d9c8f5e9f35e5df7393
-
Size
1.2MB
-
Sample
230318-jjfm4adf71
-
MD5
d7b4f8a69b1823de556a2e833c2aa845
-
SHA1
ec80e08525178f1f1e044e004d0502c6f40ec283
-
SHA256
1f4069228ad65edd78f52961421c978d089dbfe9cf318d9c8f5e9f35e5df7393
-
SHA512
c8947ebb5bba16410013e9cb1d3519befe4676c26f9d218dd7015bd94d947b36ecb3f0a690f38f2a8c0cb99f41b6c80a68f90db18c4542b5473f88f7193814df
-
SSDEEP
24576:O3fA/X9x8NfB7bCvJpAaUQMz5itmXaZH/BV:OISfBnyXAPFQis
Static task
static1
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Extracted
redline
laba
193.233.20.28:4125
-
auth_value
2cf01cffff9092a85ca7e106c547190b
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
1f4069228ad65edd78f52961421c978d089dbfe9cf318d9c8f5e9f35e5df7393
-
Size
1.2MB
-
MD5
d7b4f8a69b1823de556a2e833c2aa845
-
SHA1
ec80e08525178f1f1e044e004d0502c6f40ec283
-
SHA256
1f4069228ad65edd78f52961421c978d089dbfe9cf318d9c8f5e9f35e5df7393
-
SHA512
c8947ebb5bba16410013e9cb1d3519befe4676c26f9d218dd7015bd94d947b36ecb3f0a690f38f2a8c0cb99f41b6c80a68f90db18c4542b5473f88f7193814df
-
SSDEEP
24576:O3fA/X9x8NfB7bCvJpAaUQMz5itmXaZH/BV:OISfBnyXAPFQis
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-