General
-
Target
d0f9ffe50352ad04a1b33d21b0103c0fefcfd9cca2e334acdc3b60edbc63da57
-
Size
1.0MB
-
Sample
230321-sra71sbf93
-
MD5
3b7293a9b2127632755601db41764fc9
-
SHA1
2fa0b41098c42e9689fdfc48d65ba50a882b9581
-
SHA256
d0f9ffe50352ad04a1b33d21b0103c0fefcfd9cca2e334acdc3b60edbc63da57
-
SHA512
65fa467d5a6a24d8f0359d1ab00aa01a7c75ab27acc19dbef87cd78edf37070dc76007813641afd37ca118e8a2b7cbf58bd19cc2250f0cf2ee6a569d01cf61b3
-
SSDEEP
24576:Jy4FzblsBUVhVpwkwtFArpqAr7lhjMbMbIr:84F2KCTKp97lhw
Static task
static1
Malware Config
Extracted
redline
gena
193.233.20.30:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Extracted
redline
vint
193.233.20.30:4125
-
auth_value
fb8811912f8370b3d23bffda092d88d0
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Targets
-
-
Target
d0f9ffe50352ad04a1b33d21b0103c0fefcfd9cca2e334acdc3b60edbc63da57
-
Size
1.0MB
-
MD5
3b7293a9b2127632755601db41764fc9
-
SHA1
2fa0b41098c42e9689fdfc48d65ba50a882b9581
-
SHA256
d0f9ffe50352ad04a1b33d21b0103c0fefcfd9cca2e334acdc3b60edbc63da57
-
SHA512
65fa467d5a6a24d8f0359d1ab00aa01a7c75ab27acc19dbef87cd78edf37070dc76007813641afd37ca118e8a2b7cbf58bd19cc2250f0cf2ee6a569d01cf61b3
-
SSDEEP
24576:Jy4FzblsBUVhVpwkwtFArpqAr7lhjMbMbIr:84F2KCTKp97lhw
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-