General
-
Target
bd89c3eedbe6a7ad26283103fd92830feaf7e393b284ea8fd3ac63e0b7cc5d1c
-
Size
683KB
-
Sample
230328-k9velsaa89
-
MD5
6f32ef190599252f1df996594eed44a2
-
SHA1
0182e4c00716ef2aedff28a5a18625184fe0aa55
-
SHA256
bd89c3eedbe6a7ad26283103fd92830feaf7e393b284ea8fd3ac63e0b7cc5d1c
-
SHA512
9f7eea8e37dde305d0be6b5d7c5c731331c9c9efa606d3306a9972dbb703f9a304efb05e4328823efe1cfc708ad9fc463b5dda26cf3575276ec8169821e6b601
-
SSDEEP
12288:EMrWy90XWQQanvEbjXgShzRJOe/FgNgfUSzmfL3FOCit:iynQQAEbNlOe/0KzmfLVm
Static task
static1
Behavioral task
behavioral1
Sample
bd89c3eedbe6a7ad26283103fd92830feaf7e393b284ea8fd3ac63e0b7cc5d1c.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Targets
-
-
Target
bd89c3eedbe6a7ad26283103fd92830feaf7e393b284ea8fd3ac63e0b7cc5d1c
-
Size
683KB
-
MD5
6f32ef190599252f1df996594eed44a2
-
SHA1
0182e4c00716ef2aedff28a5a18625184fe0aa55
-
SHA256
bd89c3eedbe6a7ad26283103fd92830feaf7e393b284ea8fd3ac63e0b7cc5d1c
-
SHA512
9f7eea8e37dde305d0be6b5d7c5c731331c9c9efa606d3306a9972dbb703f9a304efb05e4328823efe1cfc708ad9fc463b5dda26cf3575276ec8169821e6b601
-
SSDEEP
12288:EMrWy90XWQQanvEbjXgShzRJOe/FgNgfUSzmfL3FOCit:iynQQAEbNlOe/0KzmfLVm
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-