General
-
Target
9f2a2fc1dda81f7747cf49a1999b87e4.exe
-
Size
866KB
-
Sample
230319-jqedlsfe62
-
MD5
9f2a2fc1dda81f7747cf49a1999b87e4
-
SHA1
5abdc7ab4c726665bccb0f1557faa860455852ff
-
SHA256
6abbeec35a40919325f069ec47dccfc1b6d4132ef0f9114acc19778f1cfd21ea
-
SHA512
7e37517c6fc135fd3905d8851b73e82df160fb03dcfc23c44562b9aa68c8a5a887d4924ab1557ef6e3a57217252ab7b0fdf7adaa4ca21889a48ee6ffda7d7e1b
-
SSDEEP
12288:xMrBy90He3BbmlZh5uxsbqVTb149z0Tf3R0f8332Jtzs6j/cRJp/Y+62uSD+R1Mb:4yo4FWLWV1+z0Tq0nEtzvcRJmCDlmc
Static task
static1
Behavioral task
behavioral1
Sample
9f2a2fc1dda81f7747cf49a1999b87e4.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
9f2a2fc1dda81f7747cf49a1999b87e4.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
gena
193.233.20.30:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Extracted
redline
relon
193.233.20.30:4125
-
auth_value
17da69809725577b595e217ba006b869
Targets
-
-
Target
9f2a2fc1dda81f7747cf49a1999b87e4.exe
-
Size
866KB
-
MD5
9f2a2fc1dda81f7747cf49a1999b87e4
-
SHA1
5abdc7ab4c726665bccb0f1557faa860455852ff
-
SHA256
6abbeec35a40919325f069ec47dccfc1b6d4132ef0f9114acc19778f1cfd21ea
-
SHA512
7e37517c6fc135fd3905d8851b73e82df160fb03dcfc23c44562b9aa68c8a5a887d4924ab1557ef6e3a57217252ab7b0fdf7adaa4ca21889a48ee6ffda7d7e1b
-
SSDEEP
12288:xMrBy90He3BbmlZh5uxsbqVTb149z0Tf3R0f8332Jtzs6j/cRJp/Y+62uSD+R1Mb:4yo4FWLWV1+z0Tq0nEtzvcRJmCDlmc
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-