General
-
Target
1933ac9f9658c4e946d7bab2b581770674aa40b82cdcd01bb2949aaa6484867d
-
Size
1.1MB
-
Sample
230409-s6ztxsde4t
-
MD5
b99e7a3743091bd22c8db7ae0b934907
-
SHA1
4fefa2337532d065f2988491d6846d7be4fdc26d
-
SHA256
1933ac9f9658c4e946d7bab2b581770674aa40b82cdcd01bb2949aaa6484867d
-
SHA512
a1d82ef4153c2c3148694e972bfb45adf756f76f8a40548129c752ff791a31ff5e9db06c59d7f2d076cbabe3fd4c4dae29a08deef119cf598a6f23da851e6669
-
SSDEEP
24576:7yKAXUTUTeZQQ79SE1Pc949aH0cxTpLelVkrxsSYki:uKc7TSZS/94spfL1rx5
Static task
static1
Malware Config
Extracted
redline
norm
77.91.124.145:4125
-
auth_value
1514e6c0ec3d10a36f68f61b206f5759
Extracted
redline
lenox
77.91.124.145:4125
-
auth_value
a5c9c17a250a084c5fd706c1df7c2d4e
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Targets
-
-
Target
1933ac9f9658c4e946d7bab2b581770674aa40b82cdcd01bb2949aaa6484867d
-
Size
1.1MB
-
MD5
b99e7a3743091bd22c8db7ae0b934907
-
SHA1
4fefa2337532d065f2988491d6846d7be4fdc26d
-
SHA256
1933ac9f9658c4e946d7bab2b581770674aa40b82cdcd01bb2949aaa6484867d
-
SHA512
a1d82ef4153c2c3148694e972bfb45adf756f76f8a40548129c752ff791a31ff5e9db06c59d7f2d076cbabe3fd4c4dae29a08deef119cf598a6f23da851e6669
-
SSDEEP
24576:7yKAXUTUTeZQQ79SE1Pc949aH0cxTpLelVkrxsSYki:uKc7TSZS/94spfL1rx5
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-