General
-
Target
bd9329afcafcbdf4dcad51840abea5d153a37fed15e7363aec3a222f36efca83
-
Size
1000KB
-
Sample
230331-v86fladd9y
-
MD5
45448e942d2d5c254df3dd21a2092a53
-
SHA1
70ea6ee6a0a9eb777da5dda4f4823ce9c67b0b85
-
SHA256
bd9329afcafcbdf4dcad51840abea5d153a37fed15e7363aec3a222f36efca83
-
SHA512
b977cc3ee356dd8e38d4d3fe36438e2d982ad64a14b4a629af870a946dad5995c5319b42e179aa9f95e574a65c5ad42f7a8915daafbdb0974aed4d679d398a01
-
SSDEEP
24576:pyEEHcTa0qUcjHQF7KyOqmo0+TsaDtzorZrli:ctHcT9co7ROPkzodl
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
lift
176.113.115.145:4125
-
auth_value
94f33c242a83de9dcc729e29ec435dfb
Extracted
amadey
3.69
193.233.20.36/joomla/index.php
Targets
-
-
Target
bd9329afcafcbdf4dcad51840abea5d153a37fed15e7363aec3a222f36efca83
-
Size
1000KB
-
MD5
45448e942d2d5c254df3dd21a2092a53
-
SHA1
70ea6ee6a0a9eb777da5dda4f4823ce9c67b0b85
-
SHA256
bd9329afcafcbdf4dcad51840abea5d153a37fed15e7363aec3a222f36efca83
-
SHA512
b977cc3ee356dd8e38d4d3fe36438e2d982ad64a14b4a629af870a946dad5995c5319b42e179aa9f95e574a65c5ad42f7a8915daafbdb0974aed4d679d398a01
-
SSDEEP
24576:pyEEHcTa0qUcjHQF7KyOqmo0+TsaDtzorZrli:ctHcT9co7ROPkzodl
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-