General
-
Target
e9a9886ab2342ded8b9def4e2223fc50ec7d734403ecbbc4f101f86dcdf55180
-
Size
689KB
-
Sample
230328-d1rh2aaf3s
-
MD5
09c9ba308332f8a07cc3fd0b1838c8d4
-
SHA1
46363edda5dc30e2e0e416ad310bab4df8847389
-
SHA256
e9a9886ab2342ded8b9def4e2223fc50ec7d734403ecbbc4f101f86dcdf55180
-
SHA512
47e6bf12128909ac225d5d48a7c656d50c14ba2a064dbc6e74298c1e914c03bd209fce4fcd63f01f1cc1a9848f3fb18397b103582d2e8bae78f27da15300af89
-
SSDEEP
12288:mMrty901dugz5bOk05U0XLxya65hLurlVYalP5UnvRmJov3FmyfigfP2/N1ZfJ7n:3ygbscpfarleap4ZmJoNmyagfQX
Static task
static1
Behavioral task
behavioral1
Sample
e9a9886ab2342ded8b9def4e2223fc50ec7d734403ecbbc4f101f86dcdf55180.exe
Resource
win10-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Targets
-
-
Target
e9a9886ab2342ded8b9def4e2223fc50ec7d734403ecbbc4f101f86dcdf55180
-
Size
689KB
-
MD5
09c9ba308332f8a07cc3fd0b1838c8d4
-
SHA1
46363edda5dc30e2e0e416ad310bab4df8847389
-
SHA256
e9a9886ab2342ded8b9def4e2223fc50ec7d734403ecbbc4f101f86dcdf55180
-
SHA512
47e6bf12128909ac225d5d48a7c656d50c14ba2a064dbc6e74298c1e914c03bd209fce4fcd63f01f1cc1a9848f3fb18397b103582d2e8bae78f27da15300af89
-
SSDEEP
12288:mMrty901dugz5bOk05U0XLxya65hLurlVYalP5UnvRmJov3FmyfigfP2/N1ZfJ7n:3ygbscpfarleap4ZmJoNmyagfQX
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-