General
-
Target
5ff9bd850f2b89df9819b48f823a375ae2969c080fa7dc07102c29f2f2587c94
-
Size
688KB
-
Sample
230328-eghmfsgh22
-
MD5
50b90aea52ee7ba4a6fdbbecaff0f9fb
-
SHA1
8e75e7be82dc60bd152baee3bb7e777b3eafb40e
-
SHA256
5ff9bd850f2b89df9819b48f823a375ae2969c080fa7dc07102c29f2f2587c94
-
SHA512
f0733cdecababec0bfd1673b3eb038638154cc8a683142cf69e35b089a7f209823a5132652e6b64e13d191201f8c811d26cd0e76940559a79616de285010e67f
-
SSDEEP
12288:JMrwy90QCJSZwojGaecvYoVyW65hLuXwqJQK3DuS9NJ6QhmJ6vSF+Sfigcp3/aQb:FyRlwoCAvc9faX7QKzuYNJnmJ6u+Sagg
Static task
static1
Behavioral task
behavioral1
Sample
5ff9bd850f2b89df9819b48f823a375ae2969c080fa7dc07102c29f2f2587c94.exe
Resource
win10-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Targets
-
-
Target
5ff9bd850f2b89df9819b48f823a375ae2969c080fa7dc07102c29f2f2587c94
-
Size
688KB
-
MD5
50b90aea52ee7ba4a6fdbbecaff0f9fb
-
SHA1
8e75e7be82dc60bd152baee3bb7e777b3eafb40e
-
SHA256
5ff9bd850f2b89df9819b48f823a375ae2969c080fa7dc07102c29f2f2587c94
-
SHA512
f0733cdecababec0bfd1673b3eb038638154cc8a683142cf69e35b089a7f209823a5132652e6b64e13d191201f8c811d26cd0e76940559a79616de285010e67f
-
SSDEEP
12288:JMrwy90QCJSZwojGaecvYoVyW65hLuXwqJQK3DuS9NJ6QhmJ6vSF+Sfigcp3/aQb:FyRlwoCAvc9faX7QKzuYNJnmJ6u+Sagg
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-