General
-
Target
278602048a85c5252e2dc520f9318353cc557115603cfebb9b7490b8badd943c
-
Size
676KB
-
Sample
230331-xxgdfacf92
-
MD5
12bcea7ef50bed7ede4a3d379fef55dd
-
SHA1
ae2bc96987a9b0e52dc651989e854b024dcdee87
-
SHA256
278602048a85c5252e2dc520f9318353cc557115603cfebb9b7490b8badd943c
-
SHA512
a73f10729bc5b6cb0312f73834a4c7693960321a89e0b49cace5f9b6154c71d5655e0308b07663c39147c1292224e179a2d2e588d58bd90115b7b7ffea807353
-
SSDEEP
12288:VMr3y90sKOaI2FxNE3j22Z0ZbQkl5gFsi9S33HI2EyDp/O1uXm80rTKxZ:Sytz2FkS2ZEkkbgFdE3d2SvSTKv
Static task
static1
Behavioral task
behavioral1
Sample
278602048a85c5252e2dc520f9318353cc557115603cfebb9b7490b8badd943c.exe
Resource
win10-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Targets
-
-
Target
278602048a85c5252e2dc520f9318353cc557115603cfebb9b7490b8badd943c
-
Size
676KB
-
MD5
12bcea7ef50bed7ede4a3d379fef55dd
-
SHA1
ae2bc96987a9b0e52dc651989e854b024dcdee87
-
SHA256
278602048a85c5252e2dc520f9318353cc557115603cfebb9b7490b8badd943c
-
SHA512
a73f10729bc5b6cb0312f73834a4c7693960321a89e0b49cace5f9b6154c71d5655e0308b07663c39147c1292224e179a2d2e588d58bd90115b7b7ffea807353
-
SSDEEP
12288:VMr3y90sKOaI2FxNE3j22Z0ZbQkl5gFsi9S33HI2EyDp/O1uXm80rTKxZ:Sytz2FkS2ZEkkbgFdE3d2SvSTKv
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-