General
-
Target
ku260293.exe
-
Size
345KB
-
Sample
230328-ea2rragg88
-
MD5
c2b4517fec935d1bb36b3e9ada66a492
-
SHA1
8a35e3edae871bef9042f063dd2c1808e21d1033
-
SHA256
2dae1f45f8df7cd6879329e22c470f539402fdda4e430e10a1f3801ef240ee0b
-
SHA512
ad5dc41d34f74d0c687765b9418441f6299d7d75d2e642e8a462220123e073fa8239eed66ee7168768bd183ace5570cec6dc7a38a32332a2cb0e8a754997c000
-
SSDEEP
6144:wiuo+rLcXfNbdX5AoKpelCoQqDmJLIGv7XpCd3bM/zDig02TpgBsDiYn:wiuTrYXfNb5yoKH2mJ/v70rOfigLKe
Static task
static1
Behavioral task
behavioral1
Sample
ku260293.exe
Resource
win7-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Targets
-
-
Target
ku260293.exe
-
Size
345KB
-
MD5
c2b4517fec935d1bb36b3e9ada66a492
-
SHA1
8a35e3edae871bef9042f063dd2c1808e21d1033
-
SHA256
2dae1f45f8df7cd6879329e22c470f539402fdda4e430e10a1f3801ef240ee0b
-
SHA512
ad5dc41d34f74d0c687765b9418441f6299d7d75d2e642e8a462220123e073fa8239eed66ee7168768bd183ace5570cec6dc7a38a32332a2cb0e8a754997c000
-
SSDEEP
6144:wiuo+rLcXfNbdX5AoKpelCoQqDmJLIGv7XpCd3bM/zDig02TpgBsDiYn:wiuTrYXfNb5yoKH2mJ/v70rOfigLKe
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-