General
-
Target
ed59f156ca0438e2f44f7cf8aec3e0a8df8675fca560bbfa83555036009e1fd3
-
Size
1.1MB
-
Sample
230409-svqf4sbe98
-
MD5
a11d22820fd13ff8809267e6bb04c0a1
-
SHA1
1844e8e466e00e6cbdd58dc4ee4782685f92dbc7
-
SHA256
ed59f156ca0438e2f44f7cf8aec3e0a8df8675fca560bbfa83555036009e1fd3
-
SHA512
0ac82bfc9a3df6e373ba19e2261952970251d9ff962409f8cc63e314651ed6a5f0199749a5cb17c36bb4752a1fb9a5490a0c3938a71ca9be2106f053160f7308
-
SSDEEP
24576:LypFTgIVnvOOuJCaLTdqaJuAxd+5xU8FDOjxx:+pFTgIpRuU+TdvNe5xg
Static task
static1
Malware Config
Extracted
redline
norm
77.91.124.145:4125
-
auth_value
1514e6c0ec3d10a36f68f61b206f5759
Extracted
redline
lenox
77.91.124.145:4125
-
auth_value
a5c9c17a250a084c5fd706c1df7c2d4e
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Targets
-
-
Target
ed59f156ca0438e2f44f7cf8aec3e0a8df8675fca560bbfa83555036009e1fd3
-
Size
1.1MB
-
MD5
a11d22820fd13ff8809267e6bb04c0a1
-
SHA1
1844e8e466e00e6cbdd58dc4ee4782685f92dbc7
-
SHA256
ed59f156ca0438e2f44f7cf8aec3e0a8df8675fca560bbfa83555036009e1fd3
-
SHA512
0ac82bfc9a3df6e373ba19e2261952970251d9ff962409f8cc63e314651ed6a5f0199749a5cb17c36bb4752a1fb9a5490a0c3938a71ca9be2106f053160f7308
-
SSDEEP
24576:LypFTgIVnvOOuJCaLTdqaJuAxd+5xU8FDOjxx:+pFTgIpRuU+TdvNe5xg
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-