General
-
Target
175050f25995f046a451626442df09707da62a34b6915504b7644de254ab32ce
-
Size
726KB
-
Sample
230326-17g99scc4s
-
MD5
c93a7dd522bbfc9040adf4eff1eee2ae
-
SHA1
d1a5bed2cf87c1ab76dd93c99f63ab3dd856a6fa
-
SHA256
175050f25995f046a451626442df09707da62a34b6915504b7644de254ab32ce
-
SHA512
2d4c42db39edb831da9a5f9ecd454a0a7ce60fe7f5d5b18b527dd9448e536d90d97d606caf3161612d63088aefce21bcd478bfd37450db8c12e048c5134fc370
-
SSDEEP
12288:Fp3JDQAu5fdU6AdozuoTnsSu07dIIaYwKFd9iGWOCKjEWf8XgtpsDUdIQEm7ZxS:Fp5u1G6AWK/C7dnap89b98Xmm/m72
Static task
static1
Behavioral task
behavioral1
Sample
175050f25995f046a451626442df09707da62a34b6915504b7644de254ab32ce.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
175050f25995f046a451626442df09707da62a34b6915504b7644de254ab32ce.exe
Resource
win10-20230220-en
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Extracted
redline
firmu
193.233.20.32:4125
-
auth_value
9f3e5e35e4a3a38fc36c5a851728aa33
Targets
-
-
Target
175050f25995f046a451626442df09707da62a34b6915504b7644de254ab32ce
-
Size
726KB
-
MD5
c93a7dd522bbfc9040adf4eff1eee2ae
-
SHA1
d1a5bed2cf87c1ab76dd93c99f63ab3dd856a6fa
-
SHA256
175050f25995f046a451626442df09707da62a34b6915504b7644de254ab32ce
-
SHA512
2d4c42db39edb831da9a5f9ecd454a0a7ce60fe7f5d5b18b527dd9448e536d90d97d606caf3161612d63088aefce21bcd478bfd37450db8c12e048c5134fc370
-
SSDEEP
12288:Fp3JDQAu5fdU6AdozuoTnsSu07dIIaYwKFd9iGWOCKjEWf8XgtpsDUdIQEm7ZxS:Fp5u1G6AWK/C7dnap89b98Xmm/m72
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-