General
-
Target
33d9fcb85756899d4b661b7d4e81c655faf9a4c379bf42b50f9b45d5882040e7
-
Size
680KB
-
Sample
230324-mz865adg73
-
MD5
029a1c5f206e5302eb1d56610e46f476
-
SHA1
62862559361ff2718590688b2cc4478b609ff791
-
SHA256
33d9fcb85756899d4b661b7d4e81c655faf9a4c379bf42b50f9b45d5882040e7
-
SHA512
92e28dc55194bd09ad47ff2680a651f1a098879de62351ccc3b88be0c76783b6f5be8ac0b219d34737bf845de1a12aed8eeec6eb4c54f21bbe378033bc116d49
-
SSDEEP
12288:YliBqa8L9z+9mDZ7wFwkEhZlR/zRbOXjTOpngeV6mxJDoh2rU0sRH:9qh96gDZ7VXhz4XHEngeV6mA5l
Static task
static1
Behavioral task
behavioral1
Sample
33d9fcb85756899d4b661b7d4e81c655faf9a4c379bf42b50f9b45d5882040e7.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
hero
193.233.20.31:4125
-
auth_value
11f3c75a88ca461bcc8d6bf60a1193e3
Targets
-
-
Target
33d9fcb85756899d4b661b7d4e81c655faf9a4c379bf42b50f9b45d5882040e7
-
Size
680KB
-
MD5
029a1c5f206e5302eb1d56610e46f476
-
SHA1
62862559361ff2718590688b2cc4478b609ff791
-
SHA256
33d9fcb85756899d4b661b7d4e81c655faf9a4c379bf42b50f9b45d5882040e7
-
SHA512
92e28dc55194bd09ad47ff2680a651f1a098879de62351ccc3b88be0c76783b6f5be8ac0b219d34737bf845de1a12aed8eeec6eb4c54f21bbe378033bc116d49
-
SSDEEP
12288:YliBqa8L9z+9mDZ7wFwkEhZlR/zRbOXjTOpngeV6mxJDoh2rU0sRH:9qh96gDZ7VXhz4XHEngeV6mA5l
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-