General
-
Target
7396d2e4cfbc570cf29c60577b5ad53c7ad4f0db4185cc8157deb053662cbc46
-
Size
466KB
-
Sample
230322-rrxkksbb7y
-
MD5
1e5bcdafee7b85c44061323ee2d1a661
-
SHA1
9091a896a490d8494eed8ae1832e1936e5be6e70
-
SHA256
7396d2e4cfbc570cf29c60577b5ad53c7ad4f0db4185cc8157deb053662cbc46
-
SHA512
4178ece66b3577565e392b3d1a8770264d4f019ed93afec4a026e1d037f29c4ab1e78a0f57cbc965b44f7e28c82ab7670a6356fd6325b4f9d806b1fcf126fed2
-
SSDEEP
6144:G+o/gU4OIjAWAJCv0iJ54X//8UmwK+EdMeY:G+o/gU4MfO0kK8UmgeY
Static task
static1
Malware Config
Extracted
redline
dozk
91.215.85.15:25916
-
auth_value
9f1dc4ff242fb8b53742acae0ef96143
Targets
-
-
Target
7396d2e4cfbc570cf29c60577b5ad53c7ad4f0db4185cc8157deb053662cbc46
-
Size
466KB
-
MD5
1e5bcdafee7b85c44061323ee2d1a661
-
SHA1
9091a896a490d8494eed8ae1832e1936e5be6e70
-
SHA256
7396d2e4cfbc570cf29c60577b5ad53c7ad4f0db4185cc8157deb053662cbc46
-
SHA512
4178ece66b3577565e392b3d1a8770264d4f019ed93afec4a026e1d037f29c4ab1e78a0f57cbc965b44f7e28c82ab7670a6356fd6325b4f9d806b1fcf126fed2
-
SSDEEP
6144:G+o/gU4OIjAWAJCv0iJ54X//8UmwK+EdMeY:G+o/gU4MfO0kK8UmgeY
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-