General
-
Target
6e6209c82a5a7e622328a66d4cb8e311d6d03f1732ed4ed1ea6653cf9455d094
-
Size
689KB
-
Sample
230318-klvepsdg6w
-
MD5
ef18f5a2afbc493c7dcf5707999f26ce
-
SHA1
7c2bac6d0ae70e83bbd479f9ed7c6b91c8c62806
-
SHA256
6e6209c82a5a7e622328a66d4cb8e311d6d03f1732ed4ed1ea6653cf9455d094
-
SHA512
a7994423964a9b1aef8c19eb04f80f084ef56c6fa5f27bdd1650bab339f8c9ed1b21278537c888c13f1df91830c074402eb145d5123b5eb8a67d012dc5732358
-
SSDEEP
12288:NMrJy90Z0isu+PayYtcAytAnFeZgOjRvUQ7iD2bAqRAA4UDACSLSRS3U0:kyf7uZyYOAenZgOtUEbAqRAqYE0
Static task
static1
Behavioral task
behavioral1
Sample
6e6209c82a5a7e622328a66d4cb8e311d6d03f1732ed4ed1ea6653cf9455d094.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
lint
193.233.20.28:4125
-
auth_value
0e95262fb78243c67430f3148303e5b7
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Targets
-
-
Target
6e6209c82a5a7e622328a66d4cb8e311d6d03f1732ed4ed1ea6653cf9455d094
-
Size
689KB
-
MD5
ef18f5a2afbc493c7dcf5707999f26ce
-
SHA1
7c2bac6d0ae70e83bbd479f9ed7c6b91c8c62806
-
SHA256
6e6209c82a5a7e622328a66d4cb8e311d6d03f1732ed4ed1ea6653cf9455d094
-
SHA512
a7994423964a9b1aef8c19eb04f80f084ef56c6fa5f27bdd1650bab339f8c9ed1b21278537c888c13f1df91830c074402eb145d5123b5eb8a67d012dc5732358
-
SSDEEP
12288:NMrJy90Z0isu+PayYtcAytAnFeZgOjRvUQ7iD2bAqRAA4UDACSLSRS3U0:kyf7uZyYOAenZgOtUEbAqRAqYE0
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-