General
-
Target
6f56a6652e5bfe6182d263fbbd696cc25977ad3fbdb7c266fddf70b3f2091b27
-
Size
1.1MB
-
Sample
230409-sfjd9add2v
-
MD5
ece4038839a04888a0675fbb6f7031d1
-
SHA1
fb00b40df295b13be2db5cad95ae79121a220f08
-
SHA256
6f56a6652e5bfe6182d263fbbd696cc25977ad3fbdb7c266fddf70b3f2091b27
-
SHA512
47d60b24afa859da6c1443c083bb4f8b5ddf211bc34085320fe68ca569065777b4b97b0ef589ceadb17f56bb08dc741c7d5e17808f327a00d79bb41593cfea95
-
SSDEEP
24576:hykbdoysAlM/Vb2r4GEdyoa5/ExCrYfNhPL/eFPG:U6K1lVyJaeYfNFI
Static task
static1
Malware Config
Extracted
redline
norm
77.91.124.145:4125
-
auth_value
1514e6c0ec3d10a36f68f61b206f5759
Extracted
redline
lenox
77.91.124.145:4125
-
auth_value
a5c9c17a250a084c5fd706c1df7c2d4e
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Targets
-
-
Target
6f56a6652e5bfe6182d263fbbd696cc25977ad3fbdb7c266fddf70b3f2091b27
-
Size
1.1MB
-
MD5
ece4038839a04888a0675fbb6f7031d1
-
SHA1
fb00b40df295b13be2db5cad95ae79121a220f08
-
SHA256
6f56a6652e5bfe6182d263fbbd696cc25977ad3fbdb7c266fddf70b3f2091b27
-
SHA512
47d60b24afa859da6c1443c083bb4f8b5ddf211bc34085320fe68ca569065777b4b97b0ef589ceadb17f56bb08dc741c7d5e17808f327a00d79bb41593cfea95
-
SSDEEP
24576:hykbdoysAlM/Vb2r4GEdyoa5/ExCrYfNhPL/eFPG:U6K1lVyJaeYfNFI
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-