General
-
Target
b1afb56416d6cab2c6407309ff9067dadf25495599d6aa9ec5eb611265b67eb2
-
Size
1019KB
-
Sample
230323-2enr1sce7z
-
MD5
a4961335e3bda3e77a90fbb80de060e7
-
SHA1
4327d3f11a7fc9115294f57658ab4999ff0d40e1
-
SHA256
b1afb56416d6cab2c6407309ff9067dadf25495599d6aa9ec5eb611265b67eb2
-
SHA512
fb7d42568e911a9ee5a236cc311ae97687f616927822129b42e6f980cdb4a486352913d875739f34280088ee5d2a3a6bab0486bd1ce999a8099a82d099588ed6
-
SSDEEP
24576:MyeIEIBD2DeNOP750gH7EeKBsy+9i4DmdWZBMv1/Ta07x:7tE4NM0gbgEyQBOTR7
Static task
static1
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
trap
193.233.20.30:4125
-
auth_value
b39a737e2e9eba88e48ab88d1061be9c
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
b1afb56416d6cab2c6407309ff9067dadf25495599d6aa9ec5eb611265b67eb2
-
Size
1019KB
-
MD5
a4961335e3bda3e77a90fbb80de060e7
-
SHA1
4327d3f11a7fc9115294f57658ab4999ff0d40e1
-
SHA256
b1afb56416d6cab2c6407309ff9067dadf25495599d6aa9ec5eb611265b67eb2
-
SHA512
fb7d42568e911a9ee5a236cc311ae97687f616927822129b42e6f980cdb4a486352913d875739f34280088ee5d2a3a6bab0486bd1ce999a8099a82d099588ed6
-
SSDEEP
24576:MyeIEIBD2DeNOP750gH7EeKBsy+9i4DmdWZBMv1/Ta07x:7tE4NM0gbgEyQBOTR7
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-