General
-
Target
c3244fc8f9f322a2015d16664fc879ec9119cb540e895ee3b165be84266d91f4
-
Size
546KB
-
Sample
230323-211cyaaf98
-
MD5
97051206c3b25c004da98e7a7348b8c3
-
SHA1
8c2c4ce3ac50a8dbef55205b54568af0f2d4b30f
-
SHA256
c3244fc8f9f322a2015d16664fc879ec9119cb540e895ee3b165be84266d91f4
-
SHA512
ee36bc481cfd63129ee6ef63eeef50fd9e1628c37d71ea0e5c0af8bae5d63d664627ca686c37b93439e05ff4cd33755d8bd37c57a37c9c3e6cbadeee3f583fdd
-
SSDEEP
6144:Kqy+bnr+Wp0yN90QEfTnVmu7BIJ+/j39vLB9ru2sO0hmP+Tb4IN0oqbltvF2/kZo:aMray90nhds+rtv3fh2TvCltNUys0R8
Static task
static1
Behavioral task
behavioral1
Sample
c3244fc8f9f322a2015d16664fc879ec9119cb540e895ee3b165be84266d91f4.exe
Resource
win10-20230220-en
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
real
193.233.20.31:4125
-
auth_value
bb22a50228754849387d5f4d1611e71b
Targets
-
-
Target
c3244fc8f9f322a2015d16664fc879ec9119cb540e895ee3b165be84266d91f4
-
Size
546KB
-
MD5
97051206c3b25c004da98e7a7348b8c3
-
SHA1
8c2c4ce3ac50a8dbef55205b54568af0f2d4b30f
-
SHA256
c3244fc8f9f322a2015d16664fc879ec9119cb540e895ee3b165be84266d91f4
-
SHA512
ee36bc481cfd63129ee6ef63eeef50fd9e1628c37d71ea0e5c0af8bae5d63d664627ca686c37b93439e05ff4cd33755d8bd37c57a37c9c3e6cbadeee3f583fdd
-
SSDEEP
6144:Kqy+bnr+Wp0yN90QEfTnVmu7BIJ+/j39vLB9ru2sO0hmP+Tb4IN0oqbltvF2/kZo:aMray90nhds+rtv3fh2TvCltNUys0R8
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-