General
-
Target
6102c87bea65f7f52f26b1f17a902ecf4fcef3c82ff88d000010d6a808181622
-
Size
672KB
-
Sample
230331-v2gtnadd3s
-
MD5
9987c40d27aed584bab2133ceb8d9696
-
SHA1
837b857e77cc029ab25e1d40f44f1a60bb6e028f
-
SHA256
6102c87bea65f7f52f26b1f17a902ecf4fcef3c82ff88d000010d6a808181622
-
SHA512
223362a760717101274191aa2dd84fa3c10088357d915429132ed41a5afac80800302f6333599db17d772202b40dc9e48a93f643f39797b48e0480843019f5df
-
SSDEEP
12288:YMrBy90jqIq/eXVpR+Bww76oS/VfT5lc5omHZ+Y552tpvjw13:Jyuq//eNDWDS25oRyGJjM
Static task
static1
Behavioral task
behavioral1
Sample
6102c87bea65f7f52f26b1f17a902ecf4fcef3c82ff88d000010d6a808181622.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Targets
-
-
Target
6102c87bea65f7f52f26b1f17a902ecf4fcef3c82ff88d000010d6a808181622
-
Size
672KB
-
MD5
9987c40d27aed584bab2133ceb8d9696
-
SHA1
837b857e77cc029ab25e1d40f44f1a60bb6e028f
-
SHA256
6102c87bea65f7f52f26b1f17a902ecf4fcef3c82ff88d000010d6a808181622
-
SHA512
223362a760717101274191aa2dd84fa3c10088357d915429132ed41a5afac80800302f6333599db17d772202b40dc9e48a93f643f39797b48e0480843019f5df
-
SSDEEP
12288:YMrBy90jqIq/eXVpR+Bww76oS/VfT5lc5omHZ+Y552tpvjw13:Jyuq//eNDWDS25oRyGJjM
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-