General
-
Target
995154d1aab232c99a38fb38887817c45497434ba01133692f670d96cd3c95a3
-
Size
1.0MB
-
Sample
230326-h73xvsfg88
-
MD5
b2d12f80fd2e690ff72c44a4f5a39cd6
-
SHA1
e1d9b8f9e005da4935de270a71a8a74a5ac9d1f2
-
SHA256
995154d1aab232c99a38fb38887817c45497434ba01133692f670d96cd3c95a3
-
SHA512
d192c01feb6b46ea52b432fe6057f283d63b419dab1660c5ce361dc56459392a700f349af559d779a21897fe3d2d20613a3667e40212d1be31f8eb572e7d71be
-
SSDEEP
24576:7ye+HbZAGiNRQWN99mCtFi1B7/v3rWFNL5TiD7SF:ue+7m8WNvZtWrWFlRL
Static task
static1
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Extracted
redline
netu
193.233.20.32:4125
-
auth_value
9641925ae487005582b5cf30476dd305
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Targets
-
-
Target
995154d1aab232c99a38fb38887817c45497434ba01133692f670d96cd3c95a3
-
Size
1.0MB
-
MD5
b2d12f80fd2e690ff72c44a4f5a39cd6
-
SHA1
e1d9b8f9e005da4935de270a71a8a74a5ac9d1f2
-
SHA256
995154d1aab232c99a38fb38887817c45497434ba01133692f670d96cd3c95a3
-
SHA512
d192c01feb6b46ea52b432fe6057f283d63b419dab1660c5ce361dc56459392a700f349af559d779a21897fe3d2d20613a3667e40212d1be31f8eb572e7d71be
-
SSDEEP
24576:7ye+HbZAGiNRQWN99mCtFi1B7/v3rWFNL5TiD7SF:ue+7m8WNvZtWrWFlRL
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-