General
-
Target
0b350a56927c8c36450a7301dee92d98a5960b14a684fd4b00de72c8f3b0a667
-
Size
1.0MB
-
Sample
230328-1xh4tade85
-
MD5
ddf265655af8bba24e4a56d5f10c521b
-
SHA1
b126dc49805711175d29ac66adffe6910a55aae0
-
SHA256
0b350a56927c8c36450a7301dee92d98a5960b14a684fd4b00de72c8f3b0a667
-
SHA512
c30551f826da5b44bde7b438383234229f656db0ecc24e1bc845a40cff36cb279c24344780bc1c0116bb639f009ec55bc9687f8888a002b5b2b7ed9025f0789d
-
SSDEEP
24576:bydX03fVUwwbwhOxKQzrfFvUAWY76TvEiw/nddZPM0nCE0KVM6lxF6p:OO3fewrhObPfFxWY76jEiw/dd/CTp6V
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
nado
176.113.115.145:4125
-
auth_value
a648e365d8e0df895a84152ad68ffc56
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Extracted
aurora
212.87.204.93:8081
Targets
-
-
Target
0b350a56927c8c36450a7301dee92d98a5960b14a684fd4b00de72c8f3b0a667
-
Size
1.0MB
-
MD5
ddf265655af8bba24e4a56d5f10c521b
-
SHA1
b126dc49805711175d29ac66adffe6910a55aae0
-
SHA256
0b350a56927c8c36450a7301dee92d98a5960b14a684fd4b00de72c8f3b0a667
-
SHA512
c30551f826da5b44bde7b438383234229f656db0ecc24e1bc845a40cff36cb279c24344780bc1c0116bb639f009ec55bc9687f8888a002b5b2b7ed9025f0789d
-
SSDEEP
24576:bydX03fVUwwbwhOxKQzrfFvUAWY76TvEiw/nddZPM0nCE0KVM6lxF6p:OO3fewrhObPfFxWY76jEiw/dd/CTp6V
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-