General
-
Target
a94c2f5d1752ea927ca7d1e5da875d61e9f0e08dfdcc357662ba01f3be555dc9
-
Size
836KB
-
Sample
230319-zp8h3aaa98
-
MD5
c4b2829d9a225c8bc92cf634c95c09be
-
SHA1
6d3cc9ea6b96aa8b5c85b61ac65694e9f09ce1fa
-
SHA256
a94c2f5d1752ea927ca7d1e5da875d61e9f0e08dfdcc357662ba01f3be555dc9
-
SHA512
6a0c2838b54546060f4474d6a0ba997de6644244aa3652041e22bc59b74863a045d03834553dbd432b9b96717ab5639d5e9c0a51c0be2b3019b2e81c49d2a22b
-
SSDEEP
24576:eyLFxZ+DzUDaTkvilkd0eXP23Cixb1DLV5:tB5mThkn+3zb1fV
Static task
static1
Behavioral task
behavioral1
Sample
a94c2f5d1752ea927ca7d1e5da875d61e9f0e08dfdcc357662ba01f3be555dc9.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
gena
193.233.20.30:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Extracted
redline
vint
193.233.20.30:4125
-
auth_value
fb8811912f8370b3d23bffda092d88d0
Targets
-
-
Target
a94c2f5d1752ea927ca7d1e5da875d61e9f0e08dfdcc357662ba01f3be555dc9
-
Size
836KB
-
MD5
c4b2829d9a225c8bc92cf634c95c09be
-
SHA1
6d3cc9ea6b96aa8b5c85b61ac65694e9f09ce1fa
-
SHA256
a94c2f5d1752ea927ca7d1e5da875d61e9f0e08dfdcc357662ba01f3be555dc9
-
SHA512
6a0c2838b54546060f4474d6a0ba997de6644244aa3652041e22bc59b74863a045d03834553dbd432b9b96717ab5639d5e9c0a51c0be2b3019b2e81c49d2a22b
-
SSDEEP
24576:eyLFxZ+DzUDaTkvilkd0eXP23Cixb1DLV5:tB5mThkn+3zb1fV
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-