General
-
Target
file.exe
-
Size
375KB
-
Sample
230328-jjnnpsbd9z
-
MD5
d2bf1d20ac97954ca86849c1f7c1a3c2
-
SHA1
7cd8869ba00b254c8dfc6aa6a649b2c20a1d0325
-
SHA256
43ae412088adb7eb0ea5df2b569d354d3d737e97b4581bb45c077b03506de5b0
-
SHA512
2108b712479e2185dd0c33db18c981768c3bd91a14685534b472b348144e959e83fd6ce49937d7133e4d92154ce6b5d3d4b8310655875b79d017e215d78f9114
-
SSDEEP
6144:7sQwFZgjDCOC3MnQFMru0g+xh4Q/KhTMwacF2X8pyMp7UJ:7sQwvg/CbMwMTg+f4m8Ttv2X+DUJ
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
Malware Config
Extracted
redline
@chicago
185.11.61.125:22344
-
auth_value
21f863e0cbd09d0681058e068d0d1d7f
Targets
-
-
Target
file.exe
-
Size
375KB
-
MD5
d2bf1d20ac97954ca86849c1f7c1a3c2
-
SHA1
7cd8869ba00b254c8dfc6aa6a649b2c20a1d0325
-
SHA256
43ae412088adb7eb0ea5df2b569d354d3d737e97b4581bb45c077b03506de5b0
-
SHA512
2108b712479e2185dd0c33db18c981768c3bd91a14685534b472b348144e959e83fd6ce49937d7133e4d92154ce6b5d3d4b8310655875b79d017e215d78f9114
-
SSDEEP
6144:7sQwFZgjDCOC3MnQFMru0g+xh4Q/KhTMwacF2X8pyMp7UJ:7sQwvg/CbMwMTg+f4m8Ttv2X+DUJ
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-