General
-
Target
abaf1887b135514dcb02a4ead483e3cf4b0302ab524ed3832f79793fceae5d93
-
Size
1024KB
-
Sample
230324-a7ax3sbb77
-
MD5
54c50707f8719cc6c1e0c83c065667e0
-
SHA1
2916e4772725cb3d9a9c9356052bc97aa47426c3
-
SHA256
abaf1887b135514dcb02a4ead483e3cf4b0302ab524ed3832f79793fceae5d93
-
SHA512
1f067aae9f9aaa1e08373f2aa0e31c897c830e23de41db83bec5532ae2b21ef80bf98f427803701d83f4d750667f81386479502fb7fcf7b1fce87baeb037916d
-
SSDEEP
24576:xywjp0ihOaWNPGCqxhZFUVFqJuRDZNHJ:kUinHPGTnFqqcRDn
Static task
static1
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
trap
193.233.20.30:4125
-
auth_value
b39a737e2e9eba88e48ab88d1061be9c
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
abaf1887b135514dcb02a4ead483e3cf4b0302ab524ed3832f79793fceae5d93
-
Size
1024KB
-
MD5
54c50707f8719cc6c1e0c83c065667e0
-
SHA1
2916e4772725cb3d9a9c9356052bc97aa47426c3
-
SHA256
abaf1887b135514dcb02a4ead483e3cf4b0302ab524ed3832f79793fceae5d93
-
SHA512
1f067aae9f9aaa1e08373f2aa0e31c897c830e23de41db83bec5532ae2b21ef80bf98f427803701d83f4d750667f81386479502fb7fcf7b1fce87baeb037916d
-
SSDEEP
24576:xywjp0ihOaWNPGCqxhZFUVFqJuRDZNHJ:kUinHPGTnFqqcRDn
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-