General
-
Target
498f00d0e535fca0565b1b540f1b2569a1d29ccbe034aabf6b2571456a0da5a9
-
Size
1.3MB
-
Sample
230321-v5hkcsec2y
-
MD5
01f05e1e74d0e167317ef2e5e40cd931
-
SHA1
1a081a70fd8ca7dc1da6cb8800e05f79183a0a16
-
SHA256
498f00d0e535fca0565b1b540f1b2569a1d29ccbe034aabf6b2571456a0da5a9
-
SHA512
0fc8613f8a92cccec6cec2187d1951c90fa6300d83827d00cad4e2ec24de7fccda4f09a9775e20999d876fc3d65e6f1b96ce58660d61744a181d8be29140e6ea
-
SSDEEP
24576:zotPC0g7RqtB09YBRwA/IJdqoKs/3eqc56RN0+f/gGrv:zCg7Rb9YLj+LGrsR
Static task
static1
Malware Config
Extracted
redline
gena
193.233.20.30:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Extracted
redline
relon
193.233.20.30:4125
-
auth_value
17da69809725577b595e217ba006b869
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
498f00d0e535fca0565b1b540f1b2569a1d29ccbe034aabf6b2571456a0da5a9
-
Size
1.3MB
-
MD5
01f05e1e74d0e167317ef2e5e40cd931
-
SHA1
1a081a70fd8ca7dc1da6cb8800e05f79183a0a16
-
SHA256
498f00d0e535fca0565b1b540f1b2569a1d29ccbe034aabf6b2571456a0da5a9
-
SHA512
0fc8613f8a92cccec6cec2187d1951c90fa6300d83827d00cad4e2ec24de7fccda4f09a9775e20999d876fc3d65e6f1b96ce58660d61744a181d8be29140e6ea
-
SSDEEP
24576:zotPC0g7RqtB09YBRwA/IJdqoKs/3eqc56RN0+f/gGrv:zCg7Rb9YLj+LGrsR
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-