General
-
Target
058dfeb907e1cebd2cc2c646cd384acb77af787e63d7d71f0f9f45cd1eecafe1
-
Size
680KB
-
Sample
230324-qq9yvaef38
-
MD5
3e1befe09c50077f08122e24c0b0a0e3
-
SHA1
8b0741fcabb788b41b5c5c7805909b459fc4a95a
-
SHA256
058dfeb907e1cebd2cc2c646cd384acb77af787e63d7d71f0f9f45cd1eecafe1
-
SHA512
cce78309df98b10b692efe2ce52484245c1d4f558a6b08c1711b45ac3c555df36690a84f92a4d956798fd6f4f7a622a0d3f0b35a4c326aa020510ca728437a94
-
SSDEEP
12288:oWhiwvydhO5fi82I8vkYVOIWEUSu+/iibwji4JLM+nOmr4A1fCXDR76:oWQdhO5fp2I8kUOZm/jbKi4i+XRhCTE
Static task
static1
Behavioral task
behavioral1
Sample
058dfeb907e1cebd2cc2c646cd384acb77af787e63d7d71f0f9f45cd1eecafe1.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
hero
193.233.20.31:4125
-
auth_value
11f3c75a88ca461bcc8d6bf60a1193e3
Targets
-
-
Target
058dfeb907e1cebd2cc2c646cd384acb77af787e63d7d71f0f9f45cd1eecafe1
-
Size
680KB
-
MD5
3e1befe09c50077f08122e24c0b0a0e3
-
SHA1
8b0741fcabb788b41b5c5c7805909b459fc4a95a
-
SHA256
058dfeb907e1cebd2cc2c646cd384acb77af787e63d7d71f0f9f45cd1eecafe1
-
SHA512
cce78309df98b10b692efe2ce52484245c1d4f558a6b08c1711b45ac3c555df36690a84f92a4d956798fd6f4f7a622a0d3f0b35a4c326aa020510ca728437a94
-
SSDEEP
12288:oWhiwvydhO5fi82I8vkYVOIWEUSu+/iibwji4JLM+nOmr4A1fCXDR76:oWQdhO5fp2I8kUOZm/jbKi4i+XRhCTE
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-