General
-
Target
4bd41065c00f9eca3b375a907a56bfe21193d12a463e8b5abf7cf3e553ec5bbe
-
Size
698KB
-
Sample
230328-njp9raaf69
-
MD5
246efc9e75588d2b61007fed7496e8df
-
SHA1
9d9c6534418e427c8a4b14b8a25dcef4a7a7f4f3
-
SHA256
4bd41065c00f9eca3b375a907a56bfe21193d12a463e8b5abf7cf3e553ec5bbe
-
SHA512
1439b82cdd8eee031f14be8944ed44450def10b4f889a0caa9cd8200a69b8a6f3743fbf2ceabd106465f6d4f44bc97af091b35049706b4d01e3a14ab5ce93331
-
SSDEEP
12288:TMr3y90VryLEbc+E8inz1og2v0L6gXGjiAxI9gavGKZNTU:syKeEb5EnZog2CpGjfI991ZNTU
Static task
static1
Behavioral task
behavioral1
Sample
4bd41065c00f9eca3b375a907a56bfe21193d12a463e8b5abf7cf3e553ec5bbe.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
muse
176.113.115.145:4125
-
auth_value
b91988a63a24940038d9262827a5320c
Targets
-
-
Target
4bd41065c00f9eca3b375a907a56bfe21193d12a463e8b5abf7cf3e553ec5bbe
-
Size
698KB
-
MD5
246efc9e75588d2b61007fed7496e8df
-
SHA1
9d9c6534418e427c8a4b14b8a25dcef4a7a7f4f3
-
SHA256
4bd41065c00f9eca3b375a907a56bfe21193d12a463e8b5abf7cf3e553ec5bbe
-
SHA512
1439b82cdd8eee031f14be8944ed44450def10b4f889a0caa9cd8200a69b8a6f3743fbf2ceabd106465f6d4f44bc97af091b35049706b4d01e3a14ab5ce93331
-
SSDEEP
12288:TMr3y90VryLEbc+E8inz1og2v0L6gXGjiAxI9gavGKZNTU:syKeEb5EnZog2CpGjfI991ZNTU
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-