General
-
Target
16d000b851603ad4e7e63095b9a825391d77fd92758a980237144a900ac78c24
-
Size
533KB
-
Sample
230331-zadp5see7t
-
MD5
17412e6beae179322389f4eeb97c4c35
-
SHA1
5fe77abe6420fbb2ff034a014dda3b0991bb1c1e
-
SHA256
16d000b851603ad4e7e63095b9a825391d77fd92758a980237144a900ac78c24
-
SHA512
7cfd44a2419f16055ae27d84ba4534651a4701d2bcbae8dd64b375ed969022bc2acbb343a84f0046c075b6e6d2089a58dd472f99ea2350f3df7372f1aca85627
-
SSDEEP
12288:SMrSy90Yb/yfMRECR0d7hiELPB75+qZ3LqQTH3ESZqv+y:8y9TTKd7jzj+qZ3GOXEky
Static task
static1
Behavioral task
behavioral1
Sample
16d000b851603ad4e7e63095b9a825391d77fd92758a980237144a900ac78c24.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Targets
-
-
Target
16d000b851603ad4e7e63095b9a825391d77fd92758a980237144a900ac78c24
-
Size
533KB
-
MD5
17412e6beae179322389f4eeb97c4c35
-
SHA1
5fe77abe6420fbb2ff034a014dda3b0991bb1c1e
-
SHA256
16d000b851603ad4e7e63095b9a825391d77fd92758a980237144a900ac78c24
-
SHA512
7cfd44a2419f16055ae27d84ba4534651a4701d2bcbae8dd64b375ed969022bc2acbb343a84f0046c075b6e6d2089a58dd472f99ea2350f3df7372f1aca85627
-
SSDEEP
12288:SMrSy90Yb/yfMRECR0d7hiELPB75+qZ3LqQTH3ESZqv+y:8y9TTKd7jzj+qZ3GOXEky
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-