General
-
Target
74b0555e8a3dd068dc8e3a443ac52b8dae6cfa70e386bfff0fcec5fabc099ef7
-
Size
690KB
-
Sample
230323-3gnepsag84
-
MD5
e58a7fa0538ba618ebe7f9384d0f0f1e
-
SHA1
da625d310162b912481eacb567de563459162776
-
SHA256
74b0555e8a3dd068dc8e3a443ac52b8dae6cfa70e386bfff0fcec5fabc099ef7
-
SHA512
f7b18ec978f30c5533abab0ede7d02ce65a77c67415f02297cd05438aec2e861e696d288ebe4e1522da70ddf5521a30e5a0ea23b42e556da40a5c8998a14c258
-
SSDEEP
12288:6MA1XlYcsasrYwYVQ7UsioJ8ijdV/EPUsWqunPfEzWfdkfvR1d/tXmwH:6M03s6w5UsPjD//sWqofEifG75tXvH
Static task
static1
Behavioral task
behavioral1
Sample
74b0555e8a3dd068dc8e3a443ac52b8dae6cfa70e386bfff0fcec5fabc099ef7.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
real
193.233.20.31:4125
-
auth_value
bb22a50228754849387d5f4d1611e71b
Targets
-
-
Target
74b0555e8a3dd068dc8e3a443ac52b8dae6cfa70e386bfff0fcec5fabc099ef7
-
Size
690KB
-
MD5
e58a7fa0538ba618ebe7f9384d0f0f1e
-
SHA1
da625d310162b912481eacb567de563459162776
-
SHA256
74b0555e8a3dd068dc8e3a443ac52b8dae6cfa70e386bfff0fcec5fabc099ef7
-
SHA512
f7b18ec978f30c5533abab0ede7d02ce65a77c67415f02297cd05438aec2e861e696d288ebe4e1522da70ddf5521a30e5a0ea23b42e556da40a5c8998a14c258
-
SSDEEP
12288:6MA1XlYcsasrYwYVQ7UsioJ8ijdV/EPUsWqunPfEzWfdkfvR1d/tXmwH:6M03s6w5UsPjD//sWqofEifG75tXvH
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-