General
-
Target
465325a3ebd9890234c2829cbb4cf3ca29f7591eb64b5bb21a1e4834410bd0b2.zip
-
Size
51KB
-
Sample
230329-skk4msad5y
-
MD5
7df5301381135a1bd18528a423f45084
-
SHA1
fc91fbf486d1c6ddce73c408376631ec2513d319
-
SHA256
f8dae4a90a7356e1dee7af8f46b7438884a5b30fd27b8026427a3ad3caaf8162
-
SHA512
065d078e040786b12cdfd2e25fd1fe5f52d613f97f330a8d9a6a9a3a322ca1178f614dff6fbbecf9d5f693dbef612c76b05a03d08c2c6d35d038774e93b947ff
-
SSDEEP
1536:4ouPTlWk9khAqTlF+wBqIKnRF/crbTIxk:43PJWkq5JF+wIL0rbGk
Behavioral task
behavioral1
Sample
465325a3ebd9890234c2829cbb4cf3ca29f7591eb64b5bb21a1e4834410bd0b2.exe
Resource
win7-20230220-en
Malware Config
Extracted
redline
nado
176.113.115.145:4125
-
auth_value
a648e365d8e0df895a84152ad68ffc56
Targets
-
-
Target
465325a3ebd9890234c2829cbb4cf3ca29f7591eb64b5bb21a1e4834410bd0b2
-
Size
175KB
-
MD5
2d5cceb9fc4dc32afd509390d93842ec
-
SHA1
c622d7bbd6ca971d1ab1fc1ae1e89314cc19b7db
-
SHA256
465325a3ebd9890234c2829cbb4cf3ca29f7591eb64b5bb21a1e4834410bd0b2
-
SHA512
bf851cdff5fad758542a46cf61d1315cc53178db44588b435b0208d2b5a01851abb3a6b0b309bafb82d04e9b234334df6fa95da0df1c209618d2a4ad1fddd360
-
SSDEEP
3072:yxqZWFFa7E6T825De559yhGfxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw+cO:gqZcMUyh
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-