General
-
Target
2953dbdd5b3ae7422e78ef8d4ff382b0190d7f966869d195674d3485e776085f
-
Size
689KB
-
Sample
230318-lvvbqsbh35
-
MD5
0d5948390966938f944beabfd6aee984
-
SHA1
749dbf3ea44093377a61407cc9f4a2006a60bf9d
-
SHA256
2953dbdd5b3ae7422e78ef8d4ff382b0190d7f966869d195674d3485e776085f
-
SHA512
a92ab455bf99b6e4db4c5b7aaf12a1fa63df4db564e8083a1a15bca6e508e87f692639d87aa193845beac3a63ba97e54c2da24bda88afceef8aa30f7ff77d0ae
-
SSDEEP
12288:yMr+y90RfxHRrP1Nt3ku7bEohPGmiV745lbTsrc9WfLZh2+O:4yUR9P1Nt37EEgUbTV9WVs/
Static task
static1
Behavioral task
behavioral1
Sample
2953dbdd5b3ae7422e78ef8d4ff382b0190d7f966869d195674d3485e776085f.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
lint
193.233.20.28:4125
-
auth_value
0e95262fb78243c67430f3148303e5b7
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Targets
-
-
Target
2953dbdd5b3ae7422e78ef8d4ff382b0190d7f966869d195674d3485e776085f
-
Size
689KB
-
MD5
0d5948390966938f944beabfd6aee984
-
SHA1
749dbf3ea44093377a61407cc9f4a2006a60bf9d
-
SHA256
2953dbdd5b3ae7422e78ef8d4ff382b0190d7f966869d195674d3485e776085f
-
SHA512
a92ab455bf99b6e4db4c5b7aaf12a1fa63df4db564e8083a1a15bca6e508e87f692639d87aa193845beac3a63ba97e54c2da24bda88afceef8aa30f7ff77d0ae
-
SSDEEP
12288:yMr+y90RfxHRrP1Nt3ku7bEohPGmiV745lbTsrc9WfLZh2+O:4yUR9P1Nt37EEgUbTV9WVs/
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-