General
-
Target
70e11e7a1e16fbff808b0f19b4905c0cc26706fc9090589c7fc3d9d73186984a
-
Size
1022KB
-
Sample
230323-3sshssah55
-
MD5
6d98e70566434c2e8b9f6936c6bbc293
-
SHA1
b12cb470bba33b9f6b48666dba790e67dfe34af6
-
SHA256
70e11e7a1e16fbff808b0f19b4905c0cc26706fc9090589c7fc3d9d73186984a
-
SHA512
2f452a31b90af99edc0f035ea8b392659ea9ab463086b35b47011345ea4f79faf05e981055b5ba84cc4cb2fb2b0eb6bc73f537765f99afe0c0a5dbbcd3b33614
-
SSDEEP
24576:fyfUg76hM44TVYvWuYaj2zpUZsFeGyiYfO5:qZ2b4TavWux2+6Ff
Static task
static1
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
trap
193.233.20.30:4125
-
auth_value
b39a737e2e9eba88e48ab88d1061be9c
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
70e11e7a1e16fbff808b0f19b4905c0cc26706fc9090589c7fc3d9d73186984a
-
Size
1022KB
-
MD5
6d98e70566434c2e8b9f6936c6bbc293
-
SHA1
b12cb470bba33b9f6b48666dba790e67dfe34af6
-
SHA256
70e11e7a1e16fbff808b0f19b4905c0cc26706fc9090589c7fc3d9d73186984a
-
SHA512
2f452a31b90af99edc0f035ea8b392659ea9ab463086b35b47011345ea4f79faf05e981055b5ba84cc4cb2fb2b0eb6bc73f537765f99afe0c0a5dbbcd3b33614
-
SSDEEP
24576:fyfUg76hM44TVYvWuYaj2zpUZsFeGyiYfO5:qZ2b4TavWux2+6Ff
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-