General
-
Target
fd84ec320d92c0fa4cdfd396a3d4f8e063217caf509cf1de8ae894b393aa2201
-
Size
1.1MB
-
Sample
230409-rx7bzadc2y
-
MD5
457c770ae196a260ace338f4b406f498
-
SHA1
ab483eb27b0fc299f1e6307c1ff52de6e7d4e3ce
-
SHA256
fd84ec320d92c0fa4cdfd396a3d4f8e063217caf509cf1de8ae894b393aa2201
-
SHA512
a1fca19884d0205c55691a673b6ea159751b688426e45ee59d831039025a3f15cbae531c0cc9a442646d882b4fa9b59b95ec3f8f5ab171f271f57e901cf7b9ca
-
SSDEEP
24576:pyfIkN44b3l8BF6Uy37Ol4HrwByW7BDKaNg+xbp3MXQ3iCzv:cAJ4nUI7HHH+BDP7jz3jz
Static task
static1
Malware Config
Extracted
redline
norm
77.91.124.145:4125
-
auth_value
1514e6c0ec3d10a36f68f61b206f5759
Extracted
redline
lenox
77.91.124.145:4125
-
auth_value
a5c9c17a250a084c5fd706c1df7c2d4e
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Targets
-
-
Target
fd84ec320d92c0fa4cdfd396a3d4f8e063217caf509cf1de8ae894b393aa2201
-
Size
1.1MB
-
MD5
457c770ae196a260ace338f4b406f498
-
SHA1
ab483eb27b0fc299f1e6307c1ff52de6e7d4e3ce
-
SHA256
fd84ec320d92c0fa4cdfd396a3d4f8e063217caf509cf1de8ae894b393aa2201
-
SHA512
a1fca19884d0205c55691a673b6ea159751b688426e45ee59d831039025a3f15cbae531c0cc9a442646d882b4fa9b59b95ec3f8f5ab171f271f57e901cf7b9ca
-
SSDEEP
24576:pyfIkN44b3l8BF6Uy37Ol4HrwByW7BDKaNg+xbp3MXQ3iCzv:cAJ4nUI7HHH+BDP7jz3jz
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-