General
-
Target
74f14bc4a927ebbfe8a7c4455f5b9b4e792b619f271227119c42f73b797a357d
-
Size
1.2MB
-
Sample
230318-lj7spadh5y
-
MD5
a1cb15e3884578516574f8e65a6cdb21
-
SHA1
c898020022293241aa46d8687ac2d8351c62a20a
-
SHA256
74f14bc4a927ebbfe8a7c4455f5b9b4e792b619f271227119c42f73b797a357d
-
SHA512
ac27bcf4d49ebf9b39069cd7e886a6602b0558bbfa61ab77b6b2b1799928afcff7af0e51b5360399e5211a550ce38bfeebd6d8c347d4561e24f03d2a7b1d7b38
-
SSDEEP
24576:5eIyKiLo5UtlhGsTlTEj/g6YvGwIvkSunwjxV7i3EV:5P5iElQlTE86dwIMSunwr
Static task
static1
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Extracted
redline
laba
193.233.20.28:4125
-
auth_value
2cf01cffff9092a85ca7e106c547190b
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
74f14bc4a927ebbfe8a7c4455f5b9b4e792b619f271227119c42f73b797a357d
-
Size
1.2MB
-
MD5
a1cb15e3884578516574f8e65a6cdb21
-
SHA1
c898020022293241aa46d8687ac2d8351c62a20a
-
SHA256
74f14bc4a927ebbfe8a7c4455f5b9b4e792b619f271227119c42f73b797a357d
-
SHA512
ac27bcf4d49ebf9b39069cd7e886a6602b0558bbfa61ab77b6b2b1799928afcff7af0e51b5360399e5211a550ce38bfeebd6d8c347d4561e24f03d2a7b1d7b38
-
SSDEEP
24576:5eIyKiLo5UtlhGsTlTEj/g6YvGwIvkSunwjxV7i3EV:5P5iElQlTE86dwIMSunwr
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-