General
-
Target
66dff50ea10300767aea0017b23baf8c0f043b6543f052c01550128ee773ff63
-
Size
695KB
-
Sample
230328-17ffnsdf49
-
MD5
fe065dacd03a112980246ece3af07278
-
SHA1
3926220fdcb5d7ecc367508fcb0d1aa86c9109a6
-
SHA256
66dff50ea10300767aea0017b23baf8c0f043b6543f052c01550128ee773ff63
-
SHA512
4bfec423a1d55e3505e6e7073e21f7dd2e80613776bae9ea75da145cc2f7640455d2129fa4fc525dfbd7a151ff9e2f64128e3539eee1c0e8976dcb6212371391
-
SSDEEP
12288:1Mr3y90vpA7NpFStlO8HYZQe0GumGLu9WhMSLDRKk5MbwHXN5y8FOuJ4:eyiYpQP5YZVumuyOUZWXDXW
Static task
static1
Behavioral task
behavioral1
Sample
66dff50ea10300767aea0017b23baf8c0f043b6543f052c01550128ee773ff63.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
66dff50ea10300767aea0017b23baf8c0f043b6543f052c01550128ee773ff63.exe
Resource
win10-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
muse
176.113.115.145:4125
-
auth_value
b91988a63a24940038d9262827a5320c
Targets
-
-
Target
66dff50ea10300767aea0017b23baf8c0f043b6543f052c01550128ee773ff63
-
Size
695KB
-
MD5
fe065dacd03a112980246ece3af07278
-
SHA1
3926220fdcb5d7ecc367508fcb0d1aa86c9109a6
-
SHA256
66dff50ea10300767aea0017b23baf8c0f043b6543f052c01550128ee773ff63
-
SHA512
4bfec423a1d55e3505e6e7073e21f7dd2e80613776bae9ea75da145cc2f7640455d2129fa4fc525dfbd7a151ff9e2f64128e3539eee1c0e8976dcb6212371391
-
SSDEEP
12288:1Mr3y90vpA7NpFStlO8HYZQe0GumGLu9WhMSLDRKk5MbwHXN5y8FOuJ4:eyiYpQP5YZVumuyOUZWXDXW
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-