General
-
Target
523402816831a0bf99ef7d15ba77ebb5
-
Size
866KB
-
Sample
230319-eastvaeg28
-
MD5
523402816831a0bf99ef7d15ba77ebb5
-
SHA1
53d198120784586eaf212ce040c8485ffa6b51ce
-
SHA256
2b36f8eab457b8376464cd92286b6fa66a8dcc35a48ecff5ffd52e24aafc5ce8
-
SHA512
9d3dd59bbb8ac92850ecdf99d67cc8343d1de3d4b8c975755e21017137ccb28c65865d1d09e32badf3e30176303d9c55e5297e79966016ad2b6d131d24ebe5b6
-
SSDEEP
12288:eMrBy90vul9hzOTz1kDNUA5yTM3Hs+EWFW9Oe0cj3bApps62BNU+r1sLd1Okc+38:/yN9h+KUT2HdEWoF0cj3UXDgUGt+38
Static task
static1
Behavioral task
behavioral1
Sample
523402816831a0bf99ef7d15ba77ebb5.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
523402816831a0bf99ef7d15ba77ebb5.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
redline
gena
193.233.20.30:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Extracted
redline
relon
193.233.20.30:4125
-
auth_value
17da69809725577b595e217ba006b869
Targets
-
-
Target
523402816831a0bf99ef7d15ba77ebb5
-
Size
866KB
-
MD5
523402816831a0bf99ef7d15ba77ebb5
-
SHA1
53d198120784586eaf212ce040c8485ffa6b51ce
-
SHA256
2b36f8eab457b8376464cd92286b6fa66a8dcc35a48ecff5ffd52e24aafc5ce8
-
SHA512
9d3dd59bbb8ac92850ecdf99d67cc8343d1de3d4b8c975755e21017137ccb28c65865d1d09e32badf3e30176303d9c55e5297e79966016ad2b6d131d24ebe5b6
-
SSDEEP
12288:eMrBy90vul9hzOTz1kDNUA5yTM3Hs+EWFW9Oe0cj3bApps62BNU+r1sLd1Okc+38:/yN9h+KUT2HdEWoF0cj3UXDgUGt+38
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-