General
-
Target
eddd0ee70352f571c912b3565f7c5732607f5a4fe67cf29f4706c58c744e5cea
-
Size
684KB
-
Sample
230328-j7e2gabe9t
-
MD5
a6450c48872a664839ba453bdf60fc5a
-
SHA1
5946a8b41e1aa6e39c89c8284d5f616606f46198
-
SHA256
eddd0ee70352f571c912b3565f7c5732607f5a4fe67cf29f4706c58c744e5cea
-
SHA512
851c74ea1b60ac51b632b5ed57163fcbf597ae08f91b7f56d48a271294c82cb92dcbb17fd4c55426954e90e3425e1e30542a1cf126659152fb16c8b32727c4d0
-
SSDEEP
12288:iMr2y90dpSc7vBjelNOVDtqls49lnIyRc5dFUBnmOLETeeWHgb:IyfcLBeOr4/nIyuPFkmOLand
Static task
static1
Behavioral task
behavioral1
Sample
eddd0ee70352f571c912b3565f7c5732607f5a4fe67cf29f4706c58c744e5cea.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Targets
-
-
Target
eddd0ee70352f571c912b3565f7c5732607f5a4fe67cf29f4706c58c744e5cea
-
Size
684KB
-
MD5
a6450c48872a664839ba453bdf60fc5a
-
SHA1
5946a8b41e1aa6e39c89c8284d5f616606f46198
-
SHA256
eddd0ee70352f571c912b3565f7c5732607f5a4fe67cf29f4706c58c744e5cea
-
SHA512
851c74ea1b60ac51b632b5ed57163fcbf597ae08f91b7f56d48a271294c82cb92dcbb17fd4c55426954e90e3425e1e30542a1cf126659152fb16c8b32727c4d0
-
SSDEEP
12288:iMr2y90dpSc7vBjelNOVDtqls49lnIyRc5dFUBnmOLETeeWHgb:IyfcLBeOr4/nIyuPFkmOLand
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-