General
-
Target
56aea7458f3be0f396b0a5525dd538f3b5bb4ee11e6b7c29e730a3853613f484
-
Size
686KB
-
Sample
230328-j4rabsbe8w
-
MD5
f9cf6ecf63139ee1a722b7f874284bf0
-
SHA1
a0c7ae2c4ab10993f10c1273205aec9901d1b618
-
SHA256
56aea7458f3be0f396b0a5525dd538f3b5bb4ee11e6b7c29e730a3853613f484
-
SHA512
2227e6417fc604002f390b795b234870161247256293ce61d9cc8391feb822c630c83c5c7d0d41787ca0e2cd3e0829e7722ef7f43f3ba8c3bd87576a2a80c61d
-
SSDEEP
12288:+Mr4y90s4xO8Rb5vsZtvir4RmrbXiP278es4GlIRbb76AUE+4uFkv4by:iyd4xO450ZtvWtyP284gIRz6A9+kQby
Static task
static1
Behavioral task
behavioral1
Sample
56aea7458f3be0f396b0a5525dd538f3b5bb4ee11e6b7c29e730a3853613f484.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Targets
-
-
Target
56aea7458f3be0f396b0a5525dd538f3b5bb4ee11e6b7c29e730a3853613f484
-
Size
686KB
-
MD5
f9cf6ecf63139ee1a722b7f874284bf0
-
SHA1
a0c7ae2c4ab10993f10c1273205aec9901d1b618
-
SHA256
56aea7458f3be0f396b0a5525dd538f3b5bb4ee11e6b7c29e730a3853613f484
-
SHA512
2227e6417fc604002f390b795b234870161247256293ce61d9cc8391feb822c630c83c5c7d0d41787ca0e2cd3e0829e7722ef7f43f3ba8c3bd87576a2a80c61d
-
SSDEEP
12288:+Mr4y90s4xO8Rb5vsZtvir4RmrbXiP278es4GlIRbb76AUE+4uFkv4by:iyd4xO450ZtvWtyP284gIRz6A9+kQby
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-