General
-
Target
4af25802c7331314577f95ee4c80d8c330e6af29b8564f286fa667ca9b0d2c9d
-
Size
1010KB
-
Sample
230324-mkyrvafg7s
-
MD5
cb92615c88c9a1a6a3b011d74c2f93d9
-
SHA1
a0e7a12a24b05ac7cd366dc072f799a975f76820
-
SHA256
4af25802c7331314577f95ee4c80d8c330e6af29b8564f286fa667ca9b0d2c9d
-
SHA512
f152a2964fddc8ce2b720d626d11ddb4f1186532eeac6d41cee854037abbe4507c0bfac57916efb7afa19b3f57742de41ea95722a8054fe45012297c04e18534
-
SSDEEP
24576:VySK5Fut91Dd+cA+hL4PDH8Xlb6WEUdX0yBmV9j/5P:wSK5ob1DdM+hMrcdhEUdXP
Static task
static1
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
roxi
193.233.20.31:4125
-
auth_value
9d8be78c896acc3cf8b8a6637a221376
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
4af25802c7331314577f95ee4c80d8c330e6af29b8564f286fa667ca9b0d2c9d
-
Size
1010KB
-
MD5
cb92615c88c9a1a6a3b011d74c2f93d9
-
SHA1
a0e7a12a24b05ac7cd366dc072f799a975f76820
-
SHA256
4af25802c7331314577f95ee4c80d8c330e6af29b8564f286fa667ca9b0d2c9d
-
SHA512
f152a2964fddc8ce2b720d626d11ddb4f1186532eeac6d41cee854037abbe4507c0bfac57916efb7afa19b3f57742de41ea95722a8054fe45012297c04e18534
-
SSDEEP
24576:VySK5Fut91Dd+cA+hL4PDH8Xlb6WEUdX0yBmV9j/5P:wSK5ob1DdM+hMrcdhEUdXP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-