General
-
Target
341492175e884c78b9752979a3b06a61442df61f8ac5c795bf5b890d294917bd.zip
-
Size
51KB
-
Sample
230328-nzm5bsag67
-
MD5
2cc3e6004571155284fe0b7b0854149f
-
SHA1
c3594e5397ddac58f7cb3a07de90c98db4cf3068
-
SHA256
e17f776c9f598f20f4c10b8da10aaa63ef2ff83309d8a9de598e178b2f2b700a
-
SHA512
2eba311eebe2b3929a9f11e213057614359acf1b1cda9e071a8f32296ac0dfe0ae652ef3167bf60faafad1e0eaf17d8a498d8e5918f540d695020366624ec9d4
-
SSDEEP
768:dtG/l++VpIvJGxNH+Uh4/GJWmgUNx7he1s8CN6xorL20A6pf1EdtWTdjDNG:dM/o+yUU/ez7sNxCyLkeAxDNG
Behavioral task
behavioral1
Sample
341492175e884c78b9752979a3b06a61442df61f8ac5c795bf5b890d294917bd.exe
Resource
win7-20230220-en
Malware Config
Extracted
redline
dent
193.233.20.33:4125
-
auth_value
e795368557f02e28e8aef6bcb279a3b0
Targets
-
-
Target
341492175e884c78b9752979a3b06a61442df61f8ac5c795bf5b890d294917bd
-
Size
175KB
-
MD5
af45d795e539bc03a9b9a809c53aae80
-
SHA1
cbbc7288cc760f890718f71b757e4c4991e7d40e
-
SHA256
341492175e884c78b9752979a3b06a61442df61f8ac5c795bf5b890d294917bd
-
SHA512
7effc821c7751c2fc6f608a73883c34bf0a23dc9a254a116d0191c4ee39b65876e57f63e534cc182af4eaa7861d0e607771e3ca50b10985f119d247942122436
-
SSDEEP
3072:s9xqZWBJaHEDgXp5lCe159Eh4bxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwY:sHqZV7ljEh
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-