General
-
Target
2b9abf63550dd7f8fe1604200ea0baa853cb76a4b2bd176ee2f5b704b77e70f6
-
Size
659KB
-
Sample
230403-we5smsaa4x
-
MD5
7b416555361cc53588a5845b4f8cf0a9
-
SHA1
3856bdd5f5ca69e6b9b6d60c90316432202c6871
-
SHA256
2b9abf63550dd7f8fe1604200ea0baa853cb76a4b2bd176ee2f5b704b77e70f6
-
SHA512
b230593d790e3ea0f8903c8e6f210c8396e4bb5f1054250d0e9d8f15107939e473ed3b0815b8a6a22f54dd4b126820513dd1dd9143a63390eac52d170293b0ae
-
SSDEEP
12288:uMrUy90stInnmyJ0VmhyWzaNouTkeA36uxck0OskrLikiUaWPA9CBdBpvl:my1ImPVAyOaNolykDsk6kiU5Pvl
Static task
static1
Behavioral task
behavioral1
Sample
2b9abf63550dd7f8fe1604200ea0baa853cb76a4b2bd176ee2f5b704b77e70f6.exe
Resource
win10-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Targets
-
-
Target
2b9abf63550dd7f8fe1604200ea0baa853cb76a4b2bd176ee2f5b704b77e70f6
-
Size
659KB
-
MD5
7b416555361cc53588a5845b4f8cf0a9
-
SHA1
3856bdd5f5ca69e6b9b6d60c90316432202c6871
-
SHA256
2b9abf63550dd7f8fe1604200ea0baa853cb76a4b2bd176ee2f5b704b77e70f6
-
SHA512
b230593d790e3ea0f8903c8e6f210c8396e4bb5f1054250d0e9d8f15107939e473ed3b0815b8a6a22f54dd4b126820513dd1dd9143a63390eac52d170293b0ae
-
SSDEEP
12288:uMrUy90stInnmyJ0VmhyWzaNouTkeA36uxck0OskrLikiUaWPA9CBdBpvl:my1ImPVAyOaNolykDsk6kiU5Pvl
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-