General
-
Target
0f39f327cf9f21bbd00405ab8ab7373a84598defd710baa90abf95016a9d1864
-
Size
536KB
-
Sample
230402-y96pjabg5t
-
MD5
8c06d071c1bf1ba68c50dd48aff71c32
-
SHA1
098dad468b0ceb6b5d2f3599602103566b3a5a1a
-
SHA256
0f39f327cf9f21bbd00405ab8ab7373a84598defd710baa90abf95016a9d1864
-
SHA512
7ae223aa158f0a916dc2c6b5e62ad82b74144037fb086535d74d3110cf465654dd8be7d1ad57fa94e516da41b5a336edb7c4245b23039ceea7312138c3d1515d
-
SSDEEP
12288:rMrWy90GLTmU0w0ZnOrbcOwhpaurbfsNUzDyHlLPbQIqSzLcgZ:hyfUw0ZnOrbclhMUENUSlLbQIjb
Static task
static1
Behavioral task
behavioral1
Sample
0f39f327cf9f21bbd00405ab8ab7373a84598defd710baa90abf95016a9d1864.exe
Resource
win10-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Targets
-
-
Target
0f39f327cf9f21bbd00405ab8ab7373a84598defd710baa90abf95016a9d1864
-
Size
536KB
-
MD5
8c06d071c1bf1ba68c50dd48aff71c32
-
SHA1
098dad468b0ceb6b5d2f3599602103566b3a5a1a
-
SHA256
0f39f327cf9f21bbd00405ab8ab7373a84598defd710baa90abf95016a9d1864
-
SHA512
7ae223aa158f0a916dc2c6b5e62ad82b74144037fb086535d74d3110cf465654dd8be7d1ad57fa94e516da41b5a336edb7c4245b23039ceea7312138c3d1515d
-
SSDEEP
12288:rMrWy90GLTmU0w0ZnOrbcOwhpaurbfsNUzDyHlLPbQIqSzLcgZ:hyfUw0ZnOrbclhMUENUSlLbQIjb
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-