General
-
Target
cb948763ae6a3a61e0965436f12ad4770636f2308874298b84630a19b76f6132.zip
-
Size
51KB
-
Sample
230328-nn8lwscd4w
-
MD5
3a1a6e71189e27489a6dc85f84fb3f52
-
SHA1
e125a6a50f3a557daf61b15e8285fc5bd260bcef
-
SHA256
d3df779364b44ab9e982f9b14e4f120f2747957a205720050ea472307142823e
-
SHA512
72dd80295c80e564e02c793db22964dc8d8866f379961a13ab119e85e14bfeb18c3fa190d69f92534940679b4ab330befd726b2f10082ceb60d1aa75dab5bd97
-
SSDEEP
768:NtG/l++VpIvJGxNH+Uh4/GJWmgUNx7he1s8CN6xorL20A6pf1EdtWTdjDN9:NM/o+yUU/ez7sNxCyLkeAxDN9
Behavioral task
behavioral1
Sample
cb948763ae6a3a61e0965436f12ad4770636f2308874298b84630a19b76f6132.exe
Resource
win7-20230220-en
Malware Config
Extracted
redline
dent
193.233.20.33:4125
-
auth_value
e795368557f02e28e8aef6bcb279a3b0
Targets
-
-
Target
cb948763ae6a3a61e0965436f12ad4770636f2308874298b84630a19b76f6132
-
Size
175KB
-
MD5
cda3fc6afbb35175030809bfc7efbc66
-
SHA1
ee7e577feb8eb383ad7fc41013a018775ea954d9
-
SHA256
cb948763ae6a3a61e0965436f12ad4770636f2308874298b84630a19b76f6132
-
SHA512
cd4dd0f9d31ab2753844e72f24979936e3e7fe840b100b2f9652f6019369e3b0072f4ee613235e8a7f522597752016855651ec23c4745d556543dcd47d617de6
-
SSDEEP
3072:s9xqZWBJaHEDgXp5lCe159Eh4bxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwY:sHqZV7ljEh
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-