General
-
Target
400553b49865109513952dd0126f8018bbb90c75bc7d87f7e96c10421758a72c
-
Size
713KB
-
Sample
230328-k7lppaaa83
-
MD5
9811692c818de9b99c3c038268757b9a
-
SHA1
60606f8d2ee8b3dce03ceb8f3b1895808983e817
-
SHA256
400553b49865109513952dd0126f8018bbb90c75bc7d87f7e96c10421758a72c
-
SHA512
564b22da93f0de63484d45872c937bf23ab26f9d9b3c7d644f88abf8cb64193bf22f9243ad2d4a6a5af2a9876a01fded3b6c46587d7c6d08c4ef3f7a8b08a5c2
-
SSDEEP
12288:kSibsV1r1eXRKAaCwprt7hyU/+BGN95KKVLQFkW31fBBv409iS9uB:i4zr6EAaCurt9bGBGN95KlFJ39gc9u
Static task
static1
Behavioral task
behavioral1
Sample
400553b49865109513952dd0126f8018bbb90c75bc7d87f7e96c10421758a72c.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Targets
-
-
Target
400553b49865109513952dd0126f8018bbb90c75bc7d87f7e96c10421758a72c
-
Size
713KB
-
MD5
9811692c818de9b99c3c038268757b9a
-
SHA1
60606f8d2ee8b3dce03ceb8f3b1895808983e817
-
SHA256
400553b49865109513952dd0126f8018bbb90c75bc7d87f7e96c10421758a72c
-
SHA512
564b22da93f0de63484d45872c937bf23ab26f9d9b3c7d644f88abf8cb64193bf22f9243ad2d4a6a5af2a9876a01fded3b6c46587d7c6d08c4ef3f7a8b08a5c2
-
SSDEEP
12288:kSibsV1r1eXRKAaCwprt7hyU/+BGN95KKVLQFkW31fBBv409iS9uB:i4zr6EAaCurt9bGBGN95KlFJ39gc9u
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-