General
-
Target
8050c3f2c5e414cce1e397889ecacc2488b6ec508ebd7bb31bb71d98e13f1588
-
Size
1009KB
-
Sample
230324-l2b4qsde73
-
MD5
ad8a4c8620be2d7142a0d16cc1f15cab
-
SHA1
9e1a3da1a35dd82e32768c55e7b7be42681bb1a9
-
SHA256
8050c3f2c5e414cce1e397889ecacc2488b6ec508ebd7bb31bb71d98e13f1588
-
SHA512
f303bfd382414dc53e18bc69019e66fbb213d160b1a98f887073bca0babb2bcbb8d4e8f6e7a73aae7936c94e99621d4910de99d310aab694249d152c57b87053
-
SSDEEP
24576:UyXN8C0hxwgKzsLxWMzeWQfVzmbXHcWIFVOXWo:jsxwgbLxWMzeWQfV+XcWqO
Static task
static1
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
roxi
193.233.20.31:4125
-
auth_value
9d8be78c896acc3cf8b8a6637a221376
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
8050c3f2c5e414cce1e397889ecacc2488b6ec508ebd7bb31bb71d98e13f1588
-
Size
1009KB
-
MD5
ad8a4c8620be2d7142a0d16cc1f15cab
-
SHA1
9e1a3da1a35dd82e32768c55e7b7be42681bb1a9
-
SHA256
8050c3f2c5e414cce1e397889ecacc2488b6ec508ebd7bb31bb71d98e13f1588
-
SHA512
f303bfd382414dc53e18bc69019e66fbb213d160b1a98f887073bca0babb2bcbb8d4e8f6e7a73aae7936c94e99621d4910de99d310aab694249d152c57b87053
-
SSDEEP
24576:UyXN8C0hxwgKzsLxWMzeWQfVzmbXHcWIFVOXWo:jsxwgbLxWMzeWQfV+XcWqO
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-