General
-
Target
b45bc631884d0f169200a096b763d2eaaa88eef8c4a8b62b679eb8cdaca4aab9
-
Size
697KB
-
Sample
230328-mqfs8aae28
-
MD5
936e61edf1e7e2b1371c1b576a3b290d
-
SHA1
a46f5fb09b25950a4e8875abf5a390ed7e86cea6
-
SHA256
b45bc631884d0f169200a096b763d2eaaa88eef8c4a8b62b679eb8cdaca4aab9
-
SHA512
9036943aa53f0061fd0c76516cac8cd73cb44ad952c7595108fdb317e803bc81d1b23ef861989fa2c9cb994490e0b4ce11b22b3022b4f6c0d5f51ceed280e02e
-
SSDEEP
12288:/Mr7y90ytlnXMPOkLl+YlZZhrp/YPx8swPVLFL6LDGjAAxI9gJ8vL4o:cyBfu+YlZH8xdwr0GjRI900Lx
Static task
static1
Behavioral task
behavioral1
Sample
b45bc631884d0f169200a096b763d2eaaa88eef8c4a8b62b679eb8cdaca4aab9.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
muse
176.113.115.145:4125
-
auth_value
b91988a63a24940038d9262827a5320c
Targets
-
-
Target
b45bc631884d0f169200a096b763d2eaaa88eef8c4a8b62b679eb8cdaca4aab9
-
Size
697KB
-
MD5
936e61edf1e7e2b1371c1b576a3b290d
-
SHA1
a46f5fb09b25950a4e8875abf5a390ed7e86cea6
-
SHA256
b45bc631884d0f169200a096b763d2eaaa88eef8c4a8b62b679eb8cdaca4aab9
-
SHA512
9036943aa53f0061fd0c76516cac8cd73cb44ad952c7595108fdb317e803bc81d1b23ef861989fa2c9cb994490e0b4ce11b22b3022b4f6c0d5f51ceed280e02e
-
SSDEEP
12288:/Mr7y90ytlnXMPOkLl+YlZZhrp/YPx8swPVLFL6LDGjAAxI9gJ8vL4o:cyBfu+YlZH8xdwr0GjRI900Lx
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-