General
-
Target
05fe1807eab970572d56c755955dd2f0231d6b3f5fb0baab6be15b77c99a3f29
-
Size
521KB
-
Sample
230403-yeazdagg72
-
MD5
9bc8a158876f9dccb9992e68856c8265
-
SHA1
5e983d0a48702f1e151933c49ffb27b60c9357fa
-
SHA256
05fe1807eab970572d56c755955dd2f0231d6b3f5fb0baab6be15b77c99a3f29
-
SHA512
173718cc0e7298df5b9fd602493abe2c091a3d1b042654b1b156b2653a2b62c32eefbe8efbdae2a3f6d38289b02852f2a58c935f5ccb8c2e547082f3e992d543
-
SSDEEP
12288:/Mr5y90zjHL8LFoATYQ8jQ0WzgH8Xyt86x4b/zWKbPGHiyz:WyWHLeZ8k0WzsZK66bKKiCyz
Static task
static1
Behavioral task
behavioral1
Sample
05fe1807eab970572d56c755955dd2f0231d6b3f5fb0baab6be15b77c99a3f29.exe
Resource
win10-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Targets
-
-
Target
05fe1807eab970572d56c755955dd2f0231d6b3f5fb0baab6be15b77c99a3f29
-
Size
521KB
-
MD5
9bc8a158876f9dccb9992e68856c8265
-
SHA1
5e983d0a48702f1e151933c49ffb27b60c9357fa
-
SHA256
05fe1807eab970572d56c755955dd2f0231d6b3f5fb0baab6be15b77c99a3f29
-
SHA512
173718cc0e7298df5b9fd602493abe2c091a3d1b042654b1b156b2653a2b62c32eefbe8efbdae2a3f6d38289b02852f2a58c935f5ccb8c2e547082f3e992d543
-
SSDEEP
12288:/Mr5y90zjHL8LFoATYQ8jQ0WzgH8Xyt86x4b/zWKbPGHiyz:WyWHLeZ8k0WzsZK66bKKiCyz
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-