General
-
Target
04146017170936cd894f37869356bebc873f6f59740ddf8de636b89760651413
-
Size
993KB
-
Sample
230401-jsjq4sab6v
-
MD5
d90632e412d765fddd0a5f9c238031d8
-
SHA1
39d2f3637c746e7b6ae4c5aa2850fbc3666a2da5
-
SHA256
04146017170936cd894f37869356bebc873f6f59740ddf8de636b89760651413
-
SHA512
e66a2437341f36900cb97f7a1a389b927f29e38235f72f9111426ccbc17f4471b349ffb6a81ad4bfde519e9fab748a7d0adbc32f953bf21f3b1a2204a384b9f0
-
SSDEEP
24576:9yAA+kZwMU+Z9w/MNZTDlJ0eWdVxY9eGtmi:YWMpHZ70VxBGtm
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
lift
176.113.115.145:4125
-
auth_value
94f33c242a83de9dcc729e29ec435dfb
Extracted
amadey
3.69
193.233.20.36/joomla/index.php
Targets
-
-
Target
04146017170936cd894f37869356bebc873f6f59740ddf8de636b89760651413
-
Size
993KB
-
MD5
d90632e412d765fddd0a5f9c238031d8
-
SHA1
39d2f3637c746e7b6ae4c5aa2850fbc3666a2da5
-
SHA256
04146017170936cd894f37869356bebc873f6f59740ddf8de636b89760651413
-
SHA512
e66a2437341f36900cb97f7a1a389b927f29e38235f72f9111426ccbc17f4471b349ffb6a81ad4bfde519e9fab748a7d0adbc32f953bf21f3b1a2204a384b9f0
-
SSDEEP
24576:9yAA+kZwMU+Z9w/MNZTDlJ0eWdVxY9eGtmi:YWMpHZ70VxBGtm
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-