General
-
Target
16a1c555faa033be0418d36141196594a5250ede513fe8bdb017d426c1c53a0b
-
Size
521KB
-
Sample
230403-wkd7waaa7z
-
MD5
f2f9d9799be6e386932b5d1551fcc129
-
SHA1
4c9da425223cfde5bb948342a5392aa279ad8d89
-
SHA256
16a1c555faa033be0418d36141196594a5250ede513fe8bdb017d426c1c53a0b
-
SHA512
9878e98bd1c9a511bf64f995562bde0176625d84002d5b877b70cba2bf903ecf6001bc086e8e55f9947dee93aba2b3397a07e301f705a50ffcf1046833090a3a
-
SSDEEP
12288:eMrSy90lflVg87dOuMpvz/wwdzbWrDzKusNrLiI0qgGx/UqUNi:EyYPno1jTVa/zpsN6Bqg8UNi
Static task
static1
Behavioral task
behavioral1
Sample
16a1c555faa033be0418d36141196594a5250ede513fe8bdb017d426c1c53a0b.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Targets
-
-
Target
16a1c555faa033be0418d36141196594a5250ede513fe8bdb017d426c1c53a0b
-
Size
521KB
-
MD5
f2f9d9799be6e386932b5d1551fcc129
-
SHA1
4c9da425223cfde5bb948342a5392aa279ad8d89
-
SHA256
16a1c555faa033be0418d36141196594a5250ede513fe8bdb017d426c1c53a0b
-
SHA512
9878e98bd1c9a511bf64f995562bde0176625d84002d5b877b70cba2bf903ecf6001bc086e8e55f9947dee93aba2b3397a07e301f705a50ffcf1046833090a3a
-
SSDEEP
12288:eMrSy90lflVg87dOuMpvz/wwdzbWrDzKusNrLiI0qgGx/UqUNi:EyYPno1jTVa/zpsN6Bqg8UNi
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-