General
-
Target
7e44d182f5eaf84abfd25a600d3566c836db308172c1bbcaf96ecfa11230d1cf
-
Size
522KB
-
Sample
230403-w6bnwage25
-
MD5
718c0fbb4951cc347d9358e3983a2fa2
-
SHA1
5be3d5f474dbad2eabfc498b910142a3b6270dbc
-
SHA256
7e44d182f5eaf84abfd25a600d3566c836db308172c1bbcaf96ecfa11230d1cf
-
SHA512
c4ec76aa0d98e93168befa0108bf1619d97ad4aa7d780ceb6031a6af6839a2cbe8e6ef6cf966eee1498aeb103035177c2b6f7fd135c587d17bf3674857dc1dda
-
SSDEEP
12288:KMrJy90E7DwMNCz0c0McyI9/6m+trhVuCy9kqb86N5Uhd:LydITT0McyI9/s/uCrm58d
Static task
static1
Behavioral task
behavioral1
Sample
7e44d182f5eaf84abfd25a600d3566c836db308172c1bbcaf96ecfa11230d1cf.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Targets
-
-
Target
7e44d182f5eaf84abfd25a600d3566c836db308172c1bbcaf96ecfa11230d1cf
-
Size
522KB
-
MD5
718c0fbb4951cc347d9358e3983a2fa2
-
SHA1
5be3d5f474dbad2eabfc498b910142a3b6270dbc
-
SHA256
7e44d182f5eaf84abfd25a600d3566c836db308172c1bbcaf96ecfa11230d1cf
-
SHA512
c4ec76aa0d98e93168befa0108bf1619d97ad4aa7d780ceb6031a6af6839a2cbe8e6ef6cf966eee1498aeb103035177c2b6f7fd135c587d17bf3674857dc1dda
-
SSDEEP
12288:KMrJy90E7DwMNCz0c0McyI9/6m+trhVuCy9kqb86N5Uhd:LydITT0McyI9/s/uCrm58d
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-