General
-
Target
70510324c4d788a1a6ddb3ee92e13b0b4a6dd2ed7a7853445bcbdf7da1433cb1
-
Size
993KB
-
Sample
230401-nx4z3ahg93
-
MD5
d603ea565f87a6ac9d72b96aa1bfabd3
-
SHA1
4d3ed4d674dcca558c42ff92c6db7cd90ccb7a67
-
SHA256
70510324c4d788a1a6ddb3ee92e13b0b4a6dd2ed7a7853445bcbdf7da1433cb1
-
SHA512
0db98b010a4306b9e6ba2c1231ee6d454d409492e6dff8f8544e714ba0c46d5025ed48d173c5969c7a3115a1f69a516c59c968c12d4068fe23186b08d7d68abc
-
SSDEEP
24576:WyoIQA4yxlpTAWx144MNy8WoewD1r4igJLT/fbJ:loIQtYlRrQrNGwV4i6/H
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
lift
176.113.115.145:4125
-
auth_value
94f33c242a83de9dcc729e29ec435dfb
Extracted
amadey
3.69
193.233.20.36/joomla/index.php
Targets
-
-
Target
70510324c4d788a1a6ddb3ee92e13b0b4a6dd2ed7a7853445bcbdf7da1433cb1
-
Size
993KB
-
MD5
d603ea565f87a6ac9d72b96aa1bfabd3
-
SHA1
4d3ed4d674dcca558c42ff92c6db7cd90ccb7a67
-
SHA256
70510324c4d788a1a6ddb3ee92e13b0b4a6dd2ed7a7853445bcbdf7da1433cb1
-
SHA512
0db98b010a4306b9e6ba2c1231ee6d454d409492e6dff8f8544e714ba0c46d5025ed48d173c5969c7a3115a1f69a516c59c968c12d4068fe23186b08d7d68abc
-
SSDEEP
24576:WyoIQA4yxlpTAWx144MNy8WoewD1r4igJLT/fbJ:loIQtYlRrQrNGwV4i6/H
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-