General
-
Target
0cbbd378395e3e1d64c49075b04c39773e16007d79e639230e3bd1636d86b51e
-
Size
672KB
-
Sample
230331-ztg7nseg4t
-
MD5
94ba353a40b67c484d5507dc5f59c745
-
SHA1
bdbf8da74a9c7ec9f7cd8e6e68a7d955eea9597c
-
SHA256
0cbbd378395e3e1d64c49075b04c39773e16007d79e639230e3bd1636d86b51e
-
SHA512
270127d328e1a857a4f74425b8393874ab7f908b74b1242e4209b64f9d45c64309f1cf863f36726eab52d25700b2a5550b8eb1cb0ff1d08ac3e8e9e836ad9514
-
SSDEEP
12288:jMr4y90VLLZXpsC534YbdmzoBKUy3LqeHOEzG:/y6LZpT53NbAzoBKUy3GeuEG
Static task
static1
Behavioral task
behavioral1
Sample
0cbbd378395e3e1d64c49075b04c39773e16007d79e639230e3bd1636d86b51e.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Targets
-
-
Target
0cbbd378395e3e1d64c49075b04c39773e16007d79e639230e3bd1636d86b51e
-
Size
672KB
-
MD5
94ba353a40b67c484d5507dc5f59c745
-
SHA1
bdbf8da74a9c7ec9f7cd8e6e68a7d955eea9597c
-
SHA256
0cbbd378395e3e1d64c49075b04c39773e16007d79e639230e3bd1636d86b51e
-
SHA512
270127d328e1a857a4f74425b8393874ab7f908b74b1242e4209b64f9d45c64309f1cf863f36726eab52d25700b2a5550b8eb1cb0ff1d08ac3e8e9e836ad9514
-
SSDEEP
12288:jMr4y90VLLZXpsC534YbdmzoBKUy3LqeHOEzG:/y6LZpT53NbAzoBKUy3GeuEG
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-