General
-
Target
4aa54a41023fbfc172b6f785fe6ff32ddedf694a587cabff1488b539585cd773
-
Size
1.0MB
-
Sample
230326-gf7w3ahf31
-
MD5
19b72c23c80169cda7f560f06d5a72f6
-
SHA1
240e99b561abac5a512a58cce69533c0052caa23
-
SHA256
4aa54a41023fbfc172b6f785fe6ff32ddedf694a587cabff1488b539585cd773
-
SHA512
a5c887383fba5a4d8c35f950c9daedbc3f603fe73edc2bd6aae73e6fcf5bdc9d5830d4ebfa47dcf2065a467721a281f23e885f39c722d325023f7df4658ed17a
-
SSDEEP
24576:cyi9v3hS3/XC0xd7cj9RkG2pi3smri0t1dj:LiJ+P1xdoqG2piHi0tT
Static task
static1
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Extracted
redline
netu
193.233.20.32:4125
-
auth_value
9641925ae487005582b5cf30476dd305
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Targets
-
-
Target
4aa54a41023fbfc172b6f785fe6ff32ddedf694a587cabff1488b539585cd773
-
Size
1.0MB
-
MD5
19b72c23c80169cda7f560f06d5a72f6
-
SHA1
240e99b561abac5a512a58cce69533c0052caa23
-
SHA256
4aa54a41023fbfc172b6f785fe6ff32ddedf694a587cabff1488b539585cd773
-
SHA512
a5c887383fba5a4d8c35f950c9daedbc3f603fe73edc2bd6aae73e6fcf5bdc9d5830d4ebfa47dcf2065a467721a281f23e885f39c722d325023f7df4658ed17a
-
SSDEEP
24576:cyi9v3hS3/XC0xd7cj9RkG2pi3smri0t1dj:LiJ+P1xdoqG2piHi0tT
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-