General
-
Target
b75393feb3ddc3c697974cf5a6acbd17f01cd6ac2813a630ee9c425bf7fb6dc3
-
Size
383KB
-
Sample
230324-va4t4sfe96
-
MD5
c7c90180451cb4291d3c8c1601bda906
-
SHA1
a144b960c55ade88db02b9775c43b75c2e7dd968
-
SHA256
b75393feb3ddc3c697974cf5a6acbd17f01cd6ac2813a630ee9c425bf7fb6dc3
-
SHA512
5750123d2274047f1b9fbfcf1b4bce0973ad1eaca45c607edc2245b21dda8d83ceb46d3cc4f3e87451bf2e6ffbaec6c1c5b609ef00eebe48f9c60e7cc8b8630a
-
SSDEEP
6144:eDajauMTbuHPGMNbkWgvdA7Uau73kd0lNpahkX4CHIUtsiYkd8va:gajau8bu3NYWgvdA7Uau73kYOG4CoQv3
Static task
static1
Malware Config
Extracted
redline
dozk
91.215.85.15:25916
-
auth_value
9f1dc4ff242fb8b53742acae0ef96143
Targets
-
-
Target
b75393feb3ddc3c697974cf5a6acbd17f01cd6ac2813a630ee9c425bf7fb6dc3
-
Size
383KB
-
MD5
c7c90180451cb4291d3c8c1601bda906
-
SHA1
a144b960c55ade88db02b9775c43b75c2e7dd968
-
SHA256
b75393feb3ddc3c697974cf5a6acbd17f01cd6ac2813a630ee9c425bf7fb6dc3
-
SHA512
5750123d2274047f1b9fbfcf1b4bce0973ad1eaca45c607edc2245b21dda8d83ceb46d3cc4f3e87451bf2e6ffbaec6c1c5b609ef00eebe48f9c60e7cc8b8630a
-
SSDEEP
6144:eDajauMTbuHPGMNbkWgvdA7Uau73kd0lNpahkX4CHIUtsiYkd8va:gajau8bu3NYWgvdA7Uau73kYOG4CoQv3
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-