General
-
Target
715082d84c639561d771534ffc476b0a574d3f6f7770b86342a7b5992e5d6c14
-
Size
672KB
-
Sample
230331-1myfrafa6s
-
MD5
6ae237a7cb27160bc04e8ff82bf65cbc
-
SHA1
74b8e0164025a76242c48c975c4e424191facc99
-
SHA256
715082d84c639561d771534ffc476b0a574d3f6f7770b86342a7b5992e5d6c14
-
SHA512
a8291f5559d4fbb5be92d9c38705caa031e1965d3f7213f047d1a1b3e5d3e444d4e4e14d73a44356b6254b7c0b354e72965d15becaa408ec8de99d9dc32a984f
-
SSDEEP
12288:EMr8y90am+ZXpSJ/wSFyCEGAgR8XsrT7ZsUMq3Ztt7Z18M3LqPd9X9K3ks3:AyUcXpI1aGA9XOPZsbqJ7V18M3GPntKn
Static task
static1
Behavioral task
behavioral1
Sample
715082d84c639561d771534ffc476b0a574d3f6f7770b86342a7b5992e5d6c14.exe
Resource
win10-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Targets
-
-
Target
715082d84c639561d771534ffc476b0a574d3f6f7770b86342a7b5992e5d6c14
-
Size
672KB
-
MD5
6ae237a7cb27160bc04e8ff82bf65cbc
-
SHA1
74b8e0164025a76242c48c975c4e424191facc99
-
SHA256
715082d84c639561d771534ffc476b0a574d3f6f7770b86342a7b5992e5d6c14
-
SHA512
a8291f5559d4fbb5be92d9c38705caa031e1965d3f7213f047d1a1b3e5d3e444d4e4e14d73a44356b6254b7c0b354e72965d15becaa408ec8de99d9dc32a984f
-
SSDEEP
12288:EMr8y90am+ZXpSJ/wSFyCEGAgR8XsrT7ZsUMq3Ztt7Z18M3LqPd9X9K3ks3:AyUcXpI1aGA9XOPZsbqJ7V18M3GPntKn
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-