General
-
Target
f7e791e18d73b82ff4311ed0e42631f1eae064adfa3885281b1580db2b02b669
-
Size
658KB
-
Sample
230403-ynkvyaaf4x
-
MD5
c6637cad71072dcd58d169d88f9f3302
-
SHA1
1fc79eac8edf17092be4e78601efeb4d2ff80b7f
-
SHA256
f7e791e18d73b82ff4311ed0e42631f1eae064adfa3885281b1580db2b02b669
-
SHA512
89a037a21bea5180607242e50dd1a9877f0a1d1694d04d054e6f6c09593e1099378a5bae077162bbda471857c1d84a9169785a5dd4ba4936756bf9292746b125
-
SSDEEP
12288:GMrMy90mI7y2w0x9WoDQIFSsntln1tonwborBmLt8QC6OmQ447zWKB68vl2uXvDb:uyahScbFBntt1mnhBmhK1m54mKkuXvP
Static task
static1
Behavioral task
behavioral1
Sample
f7e791e18d73b82ff4311ed0e42631f1eae064adfa3885281b1580db2b02b669.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Targets
-
-
Target
f7e791e18d73b82ff4311ed0e42631f1eae064adfa3885281b1580db2b02b669
-
Size
658KB
-
MD5
c6637cad71072dcd58d169d88f9f3302
-
SHA1
1fc79eac8edf17092be4e78601efeb4d2ff80b7f
-
SHA256
f7e791e18d73b82ff4311ed0e42631f1eae064adfa3885281b1580db2b02b669
-
SHA512
89a037a21bea5180607242e50dd1a9877f0a1d1694d04d054e6f6c09593e1099378a5bae077162bbda471857c1d84a9169785a5dd4ba4936756bf9292746b125
-
SSDEEP
12288:GMrMy90mI7y2w0x9WoDQIFSsntln1tonwborBmLt8QC6OmQ447zWKB68vl2uXvDb:uyahScbFBntt1mnhBmhK1m54mKkuXvP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-