General
-
Target
2a2dbff7f06b42495db5e10516cf30a9fd13ad9ec781f3d18446c510ef21326a
-
Size
690KB
-
Sample
230328-dvj7rsgg35
-
MD5
05f309cc7504cf51dec55582df4209af
-
SHA1
0b5371317efb0579d713fc1983805ebe942bce7a
-
SHA256
2a2dbff7f06b42495db5e10516cf30a9fd13ad9ec781f3d18446c510ef21326a
-
SHA512
a7f83b2799d700d8cacc068671af7d29f4f1e9a4244476fdc51a6f25c98ff02020862b5ec3ec83b839161bfcd7fef3c589948339485b8dada82071c6421355f9
-
SSDEEP
12288:oMrcy902bUKS7E0sI7yT65hLu0r2AQ1n9vhFHIfigfTKuFYS/uuD+g04/:UyNQKSAZB+fa0F89THIagf3/uuDjr
Static task
static1
Behavioral task
behavioral1
Sample
2a2dbff7f06b42495db5e10516cf30a9fd13ad9ec781f3d18446c510ef21326a.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Targets
-
-
Target
2a2dbff7f06b42495db5e10516cf30a9fd13ad9ec781f3d18446c510ef21326a
-
Size
690KB
-
MD5
05f309cc7504cf51dec55582df4209af
-
SHA1
0b5371317efb0579d713fc1983805ebe942bce7a
-
SHA256
2a2dbff7f06b42495db5e10516cf30a9fd13ad9ec781f3d18446c510ef21326a
-
SHA512
a7f83b2799d700d8cacc068671af7d29f4f1e9a4244476fdc51a6f25c98ff02020862b5ec3ec83b839161bfcd7fef3c589948339485b8dada82071c6421355f9
-
SSDEEP
12288:oMrcy902bUKS7E0sI7yT65hLu0r2AQ1n9vhFHIfigfTKuFYS/uuD+g04/:UyNQKSAZB+fa0F89THIagf3/uuDjr
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-