General
-
Target
3f8ee7d4d80e76d541d44fc93a48304ed50d4bdcd569a807e5894caa4b6fe57f
-
Size
1011KB
-
Sample
230324-mmqh9adf96
-
MD5
d1a62e207cd8fb8a3bf165bc0e42a1e4
-
SHA1
821427278ff893253e81ad3c36abe13159233cbe
-
SHA256
3f8ee7d4d80e76d541d44fc93a48304ed50d4bdcd569a807e5894caa4b6fe57f
-
SHA512
38fb4a1d6099df38d4a2330a44b35f0c1c15cfd03612ebea9418cf1baa840b73055c71a4a8a8830aa561c21b92307d702475e6bab3d61836e90ad13cc6ea0053
-
SSDEEP
24576:1yhdAB33zngbVp1lDaLNnpRTZ7owHFDCbWTwX8ZBfElMTDl1:Qh2h3sbtl25npRTZZlCswX6YM
Static task
static1
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
roxi
193.233.20.31:4125
-
auth_value
9d8be78c896acc3cf8b8a6637a221376
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
3f8ee7d4d80e76d541d44fc93a48304ed50d4bdcd569a807e5894caa4b6fe57f
-
Size
1011KB
-
MD5
d1a62e207cd8fb8a3bf165bc0e42a1e4
-
SHA1
821427278ff893253e81ad3c36abe13159233cbe
-
SHA256
3f8ee7d4d80e76d541d44fc93a48304ed50d4bdcd569a807e5894caa4b6fe57f
-
SHA512
38fb4a1d6099df38d4a2330a44b35f0c1c15cfd03612ebea9418cf1baa840b73055c71a4a8a8830aa561c21b92307d702475e6bab3d61836e90ad13cc6ea0053
-
SSDEEP
24576:1yhdAB33zngbVp1lDaLNnpRTZ7owHFDCbWTwX8ZBfElMTDl1:Qh2h3sbtl25npRTZZlCswX6YM
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-