General
-
Target
dd64c9520d6246857087bc4e57160584be549e7b94c7b80ed2fbc02eabb6b554
-
Size
1009KB
-
Sample
230324-l4jllaff8x
-
MD5
ee09655d1c61c8cc93d6e76bec9d088d
-
SHA1
1b24007d04def1476f1b66b49d8036800e9e8fa4
-
SHA256
dd64c9520d6246857087bc4e57160584be549e7b94c7b80ed2fbc02eabb6b554
-
SHA512
b86d7f057507cd00544bb350706ff9b5730bfbed580668d16d781886d057cdc3cf25ad798e22910f9e039fd5886637a22c7bcf99b35a09d49d65645ff72529f5
-
SSDEEP
24576:0yMxI0Dl2kaE6y1jYczyaAA+JAbIOebY5jVU/KRZcLv:DoIaj6yFROaAAoAbIL8jx
Static task
static1
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
roxi
193.233.20.31:4125
-
auth_value
9d8be78c896acc3cf8b8a6637a221376
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
dd64c9520d6246857087bc4e57160584be549e7b94c7b80ed2fbc02eabb6b554
-
Size
1009KB
-
MD5
ee09655d1c61c8cc93d6e76bec9d088d
-
SHA1
1b24007d04def1476f1b66b49d8036800e9e8fa4
-
SHA256
dd64c9520d6246857087bc4e57160584be549e7b94c7b80ed2fbc02eabb6b554
-
SHA512
b86d7f057507cd00544bb350706ff9b5730bfbed580668d16d781886d057cdc3cf25ad798e22910f9e039fd5886637a22c7bcf99b35a09d49d65645ff72529f5
-
SSDEEP
24576:0yMxI0Dl2kaE6y1jYczyaAA+JAbIOebY5jVU/KRZcLv:DoIaj6yFROaAAoAbIL8jx
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-