General
-
Target
30151bb882c6eb1242cf8bc3d7170af8cb1f8ce7e6d1478157e15be83e556c8b
-
Size
690KB
-
Sample
230328-eydptsgh69
-
MD5
543f09f87d5da63edc098306fc11ac0d
-
SHA1
5ec3ea8635381b80459b610542f78745190296cb
-
SHA256
30151bb882c6eb1242cf8bc3d7170af8cb1f8ce7e6d1478157e15be83e556c8b
-
SHA512
75f596ca12bd684c2b7e2d4be17add7882cf4a44e38c8c07b34e977eb36075045762cb6624af524ebe9e6cfd0b2293f9432a22d266c81267d8a125d0bca0641a
-
SSDEEP
12288:kMrUy905r0fbEFa6W6yb65hLuY8Nf3/r+tv5vFFXUfig+K44E/MgBG7Zq8:IyRjbH3GfaYmfT+B5HXUagK78
Static task
static1
Behavioral task
behavioral1
Sample
30151bb882c6eb1242cf8bc3d7170af8cb1f8ce7e6d1478157e15be83e556c8b.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Targets
-
-
Target
30151bb882c6eb1242cf8bc3d7170af8cb1f8ce7e6d1478157e15be83e556c8b
-
Size
690KB
-
MD5
543f09f87d5da63edc098306fc11ac0d
-
SHA1
5ec3ea8635381b80459b610542f78745190296cb
-
SHA256
30151bb882c6eb1242cf8bc3d7170af8cb1f8ce7e6d1478157e15be83e556c8b
-
SHA512
75f596ca12bd684c2b7e2d4be17add7882cf4a44e38c8c07b34e977eb36075045762cb6624af524ebe9e6cfd0b2293f9432a22d266c81267d8a125d0bca0641a
-
SSDEEP
12288:kMrUy905r0fbEFa6W6yb65hLuY8Nf3/r+tv5vFFXUfig+K44E/MgBG7Zq8:IyRjbH3GfaYmfT+B5HXUagK78
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-