General
-
Target
adc9796cac20a5ac0458613b288d0697d5f78338be25b57cb3bcf528954255e0
-
Size
1009KB
-
Sample
230324-k3g6psdc62
-
MD5
65851b5946c78615dc97aab7f3d62335
-
SHA1
9a84c7b1c1cc521498eba52fa1a60d75aa89d507
-
SHA256
adc9796cac20a5ac0458613b288d0697d5f78338be25b57cb3bcf528954255e0
-
SHA512
2033b54a7bb443bb591eb6c2c4ab1a3364044db5510bfcdb85ac6e9e77b730bdf36a4fb0d544e738ff668fcfb055cdc9ccf9fd22dd076b099fcf02a64136aa0f
-
SSDEEP
24576:yyzHu31Ev9HY5Hu1wprvstfuMitibItmP84xxGPJWK:ZVauKrkBuDtWEmP84xxG
Static task
static1
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
roxi
193.233.20.31:4125
-
auth_value
9d8be78c896acc3cf8b8a6637a221376
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
adc9796cac20a5ac0458613b288d0697d5f78338be25b57cb3bcf528954255e0
-
Size
1009KB
-
MD5
65851b5946c78615dc97aab7f3d62335
-
SHA1
9a84c7b1c1cc521498eba52fa1a60d75aa89d507
-
SHA256
adc9796cac20a5ac0458613b288d0697d5f78338be25b57cb3bcf528954255e0
-
SHA512
2033b54a7bb443bb591eb6c2c4ab1a3364044db5510bfcdb85ac6e9e77b730bdf36a4fb0d544e738ff668fcfb055cdc9ccf9fd22dd076b099fcf02a64136aa0f
-
SSDEEP
24576:yyzHu31Ev9HY5Hu1wprvstfuMitibItmP84xxGPJWK:ZVauKrkBuDtWEmP84xxG
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-