General
-
Target
67e240b48a5f8496963e71e065890531cfbccdbae8184f77c6cd3a47fabbfa8f
-
Size
1.2MB
-
Sample
230318-jq3q7sdf9z
-
MD5
3ca7b68847a1c442ab27419692b2577d
-
SHA1
ff5c2c994f3f0f4ce9837a88d91199e524a94163
-
SHA256
67e240b48a5f8496963e71e065890531cfbccdbae8184f77c6cd3a47fabbfa8f
-
SHA512
c9a6d1d4750c769f4b4be746f21656b196c3ac8d0433297764b6f361340ed99b7402ec9839a4c80635c43b87e6b6f9e4b41d435e2aaafa7d7188298d08a9ee4c
-
SSDEEP
24576:f3fA/X9x8NfB7bCvJpAaUQMz5itmXaZH/BV:fISfBnyXAPFQis
Static task
static1
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Extracted
redline
laba
193.233.20.28:4125
-
auth_value
2cf01cffff9092a85ca7e106c547190b
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
67e240b48a5f8496963e71e065890531cfbccdbae8184f77c6cd3a47fabbfa8f
-
Size
1.2MB
-
MD5
3ca7b68847a1c442ab27419692b2577d
-
SHA1
ff5c2c994f3f0f4ce9837a88d91199e524a94163
-
SHA256
67e240b48a5f8496963e71e065890531cfbccdbae8184f77c6cd3a47fabbfa8f
-
SHA512
c9a6d1d4750c769f4b4be746f21656b196c3ac8d0433297764b6f361340ed99b7402ec9839a4c80635c43b87e6b6f9e4b41d435e2aaafa7d7188298d08a9ee4c
-
SSDEEP
24576:f3fA/X9x8NfB7bCvJpAaUQMz5itmXaZH/BV:fISfBnyXAPFQis
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-