General
-
Target
4aa6048b759901a4930f049193d37c3917c8146bb41c53ee1e1bc72b630a3184
-
Size
1.0MB
-
Sample
230326-b56seahb3v
-
MD5
1eeddb5a01200cebae25f617b4510909
-
SHA1
29e6842b8e102b89189059034328209a3a7e9f7a
-
SHA256
4aa6048b759901a4930f049193d37c3917c8146bb41c53ee1e1bc72b630a3184
-
SHA512
6800aec70d8d345b740c4cced95e0abf7d3d8fb1d9f9e1ad9853f5ecd0a1feebe9f6ce64bdd69b3f1769328eb1481a3679b2409b3dc93d74fd07dd1d393b6b96
-
SSDEEP
24576:0y2GbdSX5WnHQ3wBS0odemzKqac9p1NJO:D9+5D36Shem2qac9p
Static task
static1
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Extracted
redline
netu
193.233.20.32:4125
-
auth_value
9641925ae487005582b5cf30476dd305
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Targets
-
-
Target
4aa6048b759901a4930f049193d37c3917c8146bb41c53ee1e1bc72b630a3184
-
Size
1.0MB
-
MD5
1eeddb5a01200cebae25f617b4510909
-
SHA1
29e6842b8e102b89189059034328209a3a7e9f7a
-
SHA256
4aa6048b759901a4930f049193d37c3917c8146bb41c53ee1e1bc72b630a3184
-
SHA512
6800aec70d8d345b740c4cced95e0abf7d3d8fb1d9f9e1ad9853f5ecd0a1feebe9f6ce64bdd69b3f1769328eb1481a3679b2409b3dc93d74fd07dd1d393b6b96
-
SSDEEP
24576:0y2GbdSX5WnHQ3wBS0odemzKqac9p1NJO:D9+5D36Shem2qac9p
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-