General
-
Target
886e0f946fbf10ccc557c8758f367c7129284c2a4fcbdeb35da50086469fb13a
-
Size
991KB
-
Sample
230401-l5ec9sag2v
-
MD5
0a772df8600e41a7d310c30dc23af5e3
-
SHA1
04fcf86b966a97d147a05fdf190c8f3eee6bfe17
-
SHA256
886e0f946fbf10ccc557c8758f367c7129284c2a4fcbdeb35da50086469fb13a
-
SHA512
b4942218152b19c48468bf85a4a460cb776e2b06353ac9aec4579f995651662f1391ac92ade02c280a76b5aa71bb5c84be38ca53c11cf85fa5b15ab6dfca7067
-
SSDEEP
12288:jMray90TsL3g3D06mvP1omQ4Rlp7V0h1j70KxP3vYUOlJqq53N4IrzEgzrqd2TIk:ty+4ww603Rc1P0MP3vYZ3WmYgjIoN
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
lift
176.113.115.145:4125
-
auth_value
94f33c242a83de9dcc729e29ec435dfb
Extracted
amadey
3.69
193.233.20.36/joomla/index.php
Targets
-
-
Target
886e0f946fbf10ccc557c8758f367c7129284c2a4fcbdeb35da50086469fb13a
-
Size
991KB
-
MD5
0a772df8600e41a7d310c30dc23af5e3
-
SHA1
04fcf86b966a97d147a05fdf190c8f3eee6bfe17
-
SHA256
886e0f946fbf10ccc557c8758f367c7129284c2a4fcbdeb35da50086469fb13a
-
SHA512
b4942218152b19c48468bf85a4a460cb776e2b06353ac9aec4579f995651662f1391ac92ade02c280a76b5aa71bb5c84be38ca53c11cf85fa5b15ab6dfca7067
-
SSDEEP
12288:jMray90TsL3g3D06mvP1omQ4Rlp7V0h1j70KxP3vYUOlJqq53N4IrzEgzrqd2TIk:ty+4ww603Rc1P0MP3vYZ3WmYgjIoN
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-