General
-
Target
5bd9e5e34af2e8e5b50fa87b1611338636ce5bf4bbacc6b5b5638cfba0be33a7
-
Size
311KB
-
Sample
230323-vfky7aah9y
-
MD5
2188d35bad9aef1a71accb133d45c34e
-
SHA1
612f802ef7aa3170ccc6853b38aa57dc243a1e48
-
SHA256
5bd9e5e34af2e8e5b50fa87b1611338636ce5bf4bbacc6b5b5638cfba0be33a7
-
SHA512
73bb9ae94ad9bcfd96bf0ca686a780f3d696904aa687414ce5619968656d90ae1b31a1d21a46b337a8f219f565b2831bc91decc20b57e2a53b2c830a76449872
-
SSDEEP
6144:d+8rLSM2xP7Z3wYo6OttfZI8FId2QWtHL2e3ALjBJeTcoD:I8rOM2xP7Z3DoXtRa8MpWFiewLN
Static task
static1
Malware Config
Extracted
redline
dozk
91.215.85.15:25916
-
auth_value
9f1dc4ff242fb8b53742acae0ef96143
Targets
-
-
Target
5bd9e5e34af2e8e5b50fa87b1611338636ce5bf4bbacc6b5b5638cfba0be33a7
-
Size
311KB
-
MD5
2188d35bad9aef1a71accb133d45c34e
-
SHA1
612f802ef7aa3170ccc6853b38aa57dc243a1e48
-
SHA256
5bd9e5e34af2e8e5b50fa87b1611338636ce5bf4bbacc6b5b5638cfba0be33a7
-
SHA512
73bb9ae94ad9bcfd96bf0ca686a780f3d696904aa687414ce5619968656d90ae1b31a1d21a46b337a8f219f565b2831bc91decc20b57e2a53b2c830a76449872
-
SSDEEP
6144:d+8rLSM2xP7Z3wYo6OttfZI8FId2QWtHL2e3ALjBJeTcoD:I8rOM2xP7Z3DoXtRa8MpWFiewLN
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-