General
-
Target
90194ca2b5b7d63ec4f2a21f03991263892b1ac3ddd3abe268a650a92f05282e
-
Size
1009KB
-
Sample
230324-pc65cseb94
-
MD5
82415ae8782e82b78f3a83aa5eaf7f7a
-
SHA1
df7567b7dfaf4eba92cf3deb6833e687ac35ee6b
-
SHA256
90194ca2b5b7d63ec4f2a21f03991263892b1ac3ddd3abe268a650a92f05282e
-
SHA512
3e114a2d6ce4adf00ec6820fd24ffd44af085a5ace108a08654a13d5ad4c864aa5159e45379fdc1a820606a00d03927ab99e1dee4d3e5b3e44fe6453b71cb665
-
SSDEEP
24576:WyQDR51j67jUuEiAac0k2c4eFDkLd0tyaSmDZ:lQI7jUys0DKgLmtXS
Static task
static1
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
volya
193.233.20.31:4125
-
auth_value
0efc9f002a9fbeec5f8b8338141d546a
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Targets
-
-
Target
90194ca2b5b7d63ec4f2a21f03991263892b1ac3ddd3abe268a650a92f05282e
-
Size
1009KB
-
MD5
82415ae8782e82b78f3a83aa5eaf7f7a
-
SHA1
df7567b7dfaf4eba92cf3deb6833e687ac35ee6b
-
SHA256
90194ca2b5b7d63ec4f2a21f03991263892b1ac3ddd3abe268a650a92f05282e
-
SHA512
3e114a2d6ce4adf00ec6820fd24ffd44af085a5ace108a08654a13d5ad4c864aa5159e45379fdc1a820606a00d03927ab99e1dee4d3e5b3e44fe6453b71cb665
-
SSDEEP
24576:WyQDR51j67jUuEiAac0k2c4eFDkLd0tyaSmDZ:lQI7jUys0DKgLmtXS
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-