General
-
Target
1b219721d1941f28c0a0fbdbaa82e39d02c1506da9f27b6a4dca7e9feb006816
-
Size
664KB
-
Sample
230328-edqhwsaf6y
-
MD5
1e597b7dad08bf05aec8e6abef5acc79
-
SHA1
8ba72b49a3db5983fe66e593ffa3e2345ee132d4
-
SHA256
1b219721d1941f28c0a0fbdbaa82e39d02c1506da9f27b6a4dca7e9feb006816
-
SHA512
d07866abd20c772bcd3682c72494c89e919f21a2362fede58eae6ad0ff968f951291b223a22e146638180a7cffa03aba98ae694ac23d021709052dc16cfc2c0f
-
SSDEEP
12288:OVaVtadukTDcT7VqrPl/eo2E+4YoOOvpv0V7f40cKkyRluPsyM06u44CexnI:OVCiIfMr9/12EbYo9xUf40cKkyn9yM0a
Static task
static1
Behavioral task
behavioral1
Sample
1b219721d1941f28c0a0fbdbaa82e39d02c1506da9f27b6a4dca7e9feb006816.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Targets
-
-
Target
1b219721d1941f28c0a0fbdbaa82e39d02c1506da9f27b6a4dca7e9feb006816
-
Size
664KB
-
MD5
1e597b7dad08bf05aec8e6abef5acc79
-
SHA1
8ba72b49a3db5983fe66e593ffa3e2345ee132d4
-
SHA256
1b219721d1941f28c0a0fbdbaa82e39d02c1506da9f27b6a4dca7e9feb006816
-
SHA512
d07866abd20c772bcd3682c72494c89e919f21a2362fede58eae6ad0ff968f951291b223a22e146638180a7cffa03aba98ae694ac23d021709052dc16cfc2c0f
-
SSDEEP
12288:OVaVtadukTDcT7VqrPl/eo2E+4YoOOvpv0V7f40cKkyRluPsyM06u44CexnI:OVCiIfMr9/12EbYo9xUf40cKkyn9yM0a
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-