General
-
Target
954a1107e8881be8bb1fc0b0b0221894d9df7c92f5831ddf144a4780488e5d43
-
Size
346KB
-
Sample
230323-yz2b3ahh59
-
MD5
9cf3298901842c643243c9e3cd31ac56
-
SHA1
bdf63819bcec3439a44399ebf51df0aecf79a64e
-
SHA256
954a1107e8881be8bb1fc0b0b0221894d9df7c92f5831ddf144a4780488e5d43
-
SHA512
053d3a92671eba2361d5b9d1fb74c45f4d07a9a23e62cc01ceb8792515d2e15f3b7185e3d9ae5d7081c23eaee3d2c36feb08705c019add0d7fc343b0721bb1f6
-
SSDEEP
6144:mHm2hLWK6w5smg+wVeYfqNCkedR0/5FX46KHy7DE7kj:am2hiK6w5smgnlfqNCklFXDKHeDh
Static task
static1
Malware Config
Extracted
redline
dozk
91.215.85.15:25916
-
auth_value
9f1dc4ff242fb8b53742acae0ef96143
Targets
-
-
Target
954a1107e8881be8bb1fc0b0b0221894d9df7c92f5831ddf144a4780488e5d43
-
Size
346KB
-
MD5
9cf3298901842c643243c9e3cd31ac56
-
SHA1
bdf63819bcec3439a44399ebf51df0aecf79a64e
-
SHA256
954a1107e8881be8bb1fc0b0b0221894d9df7c92f5831ddf144a4780488e5d43
-
SHA512
053d3a92671eba2361d5b9d1fb74c45f4d07a9a23e62cc01ceb8792515d2e15f3b7185e3d9ae5d7081c23eaee3d2c36feb08705c019add0d7fc343b0721bb1f6
-
SSDEEP
6144:mHm2hLWK6w5smg+wVeYfqNCkedR0/5FX46KHy7DE7kj:am2hiK6w5smgnlfqNCklFXDKHeDh
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-