General
-
Target
3d82750be163fb8611f06b2a9ecc6ebd9fc3d799a628a1e93f424743c44883ab
-
Size
1.0MB
-
Sample
230326-ch8txsfb94
-
MD5
19d9261606d304707851f7edbb66a7df
-
SHA1
ac76d68862c542c2cd63ee9d4322a4a2e31ec7f9
-
SHA256
3d82750be163fb8611f06b2a9ecc6ebd9fc3d799a628a1e93f424743c44883ab
-
SHA512
2e74647f9a736647c9bfcaeda0e27363755d1691bd2e2cad5bb11d813d030670bc6a88f9cb837ba075da82316c5d9bfb9e5ee1b1d1eba4b015c035a32ab3ff5a
-
SSDEEP
24576:IyY0HmJlPTUabXaedRJXJNEDx/9uAVA/PlobW:PdHmJlzaedf6d9utX
Static task
static1
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Extracted
redline
netu
193.233.20.32:4125
-
auth_value
9641925ae487005582b5cf30476dd305
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Targets
-
-
Target
3d82750be163fb8611f06b2a9ecc6ebd9fc3d799a628a1e93f424743c44883ab
-
Size
1.0MB
-
MD5
19d9261606d304707851f7edbb66a7df
-
SHA1
ac76d68862c542c2cd63ee9d4322a4a2e31ec7f9
-
SHA256
3d82750be163fb8611f06b2a9ecc6ebd9fc3d799a628a1e93f424743c44883ab
-
SHA512
2e74647f9a736647c9bfcaeda0e27363755d1691bd2e2cad5bb11d813d030670bc6a88f9cb837ba075da82316c5d9bfb9e5ee1b1d1eba4b015c035a32ab3ff5a
-
SSDEEP
24576:IyY0HmJlPTUabXaedRJXJNEDx/9uAVA/PlobW:PdHmJlzaedf6d9utX
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-