General
-
Target
dfcfa98adf3fe027b82802c2ba0a496fb54e7fe39ce120134ee2529984168ebc
-
Size
991KB
-
Sample
230401-mqsssaah3t
-
MD5
3a03a97f25dd9bc1d4b0c41c3bcebb22
-
SHA1
3885b14ad7af27dca84b882b0febfdf107dfb1b3
-
SHA256
dfcfa98adf3fe027b82802c2ba0a496fb54e7fe39ce120134ee2529984168ebc
-
SHA512
4e4ac0fd49c34c7459cb0137ba0045f719290fc743b875b30ba57e742617753dd4048647a38d0e0fb13edfadf25151a61b096a7aa907ccb25e437cf681793b03
-
SSDEEP
24576:kyL/uTj9J+BS+ut2kcXjcQK+i8u1LmMZUYBQVYvRf:zLa+NuAkcXbKwMuYZv
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
lift
176.113.115.145:4125
-
auth_value
94f33c242a83de9dcc729e29ec435dfb
Extracted
amadey
3.69
193.233.20.36/joomla/index.php
Targets
-
-
Target
dfcfa98adf3fe027b82802c2ba0a496fb54e7fe39ce120134ee2529984168ebc
-
Size
991KB
-
MD5
3a03a97f25dd9bc1d4b0c41c3bcebb22
-
SHA1
3885b14ad7af27dca84b882b0febfdf107dfb1b3
-
SHA256
dfcfa98adf3fe027b82802c2ba0a496fb54e7fe39ce120134ee2529984168ebc
-
SHA512
4e4ac0fd49c34c7459cb0137ba0045f719290fc743b875b30ba57e742617753dd4048647a38d0e0fb13edfadf25151a61b096a7aa907ccb25e437cf681793b03
-
SSDEEP
24576:kyL/uTj9J+BS+ut2kcXjcQK+i8u1LmMZUYBQVYvRf:zLa+NuAkcXbKwMuYZv
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-