General
-
Target
ec676f4c4039b26b77788e5761610602ed31f67fc63bb9a15330041dc132e153
-
Size
992KB
-
Sample
230401-m5zjwaba2z
-
MD5
a715159609e663df50e64498a13f44be
-
SHA1
041983400e2a1fd57fa5498be09357d8588ae7a4
-
SHA256
ec676f4c4039b26b77788e5761610602ed31f67fc63bb9a15330041dc132e153
-
SHA512
c2dc56a5ba73f222e95a7127d6d3069e7163e33c32d4f4ac20e2d544749d1b91c965465c9558015187e71eff72374ae5200cdf9e0dbc400dfc13860fdc060777
-
SSDEEP
24576:0yDTqSKpM3/um/ZWxc5BsU4qGxmQ8a5f/qNiqqO0:DD/3/HRWG5uAv5iqD
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
lift
176.113.115.145:4125
-
auth_value
94f33c242a83de9dcc729e29ec435dfb
Extracted
amadey
3.69
193.233.20.36/joomla/index.php
Targets
-
-
Target
ec676f4c4039b26b77788e5761610602ed31f67fc63bb9a15330041dc132e153
-
Size
992KB
-
MD5
a715159609e663df50e64498a13f44be
-
SHA1
041983400e2a1fd57fa5498be09357d8588ae7a4
-
SHA256
ec676f4c4039b26b77788e5761610602ed31f67fc63bb9a15330041dc132e153
-
SHA512
c2dc56a5ba73f222e95a7127d6d3069e7163e33c32d4f4ac20e2d544749d1b91c965465c9558015187e71eff72374ae5200cdf9e0dbc400dfc13860fdc060777
-
SSDEEP
24576:0yDTqSKpM3/um/ZWxc5BsU4qGxmQ8a5f/qNiqqO0:DD/3/HRWG5uAv5iqD
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-