General
-
Target
84e8917abb66b06ac7009b6c80a789fca7c84104dea0c6735205b9fb96dc8f60
-
Size
785KB
-
Sample
230409-yyvg5aef8x
-
MD5
68d6510d8170f6d4e268b3ce27412ec3
-
SHA1
37ab39d011340bd88faf7e49e5ea70a5d6201cb5
-
SHA256
84e8917abb66b06ac7009b6c80a789fca7c84104dea0c6735205b9fb96dc8f60
-
SHA512
33f24f25ccd5aba2b887b779514ce67e06069866f230fa9cf8f1fc767dd6c0a630d35456d76c0530abc8ec95c413b5218234cebc35170c9024b0bf4e34ec2672
-
SSDEEP
12288:EMr8y90rfhUZ+Ab2tgU7BhJ8aIN+TKwniClZunrFzb0bjls9reP3By0GpaLi:IycgJ2/b8VoTKvyZuntb0mIRDJi
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Targets
-
-
Target
84e8917abb66b06ac7009b6c80a789fca7c84104dea0c6735205b9fb96dc8f60
-
Size
785KB
-
MD5
68d6510d8170f6d4e268b3ce27412ec3
-
SHA1
37ab39d011340bd88faf7e49e5ea70a5d6201cb5
-
SHA256
84e8917abb66b06ac7009b6c80a789fca7c84104dea0c6735205b9fb96dc8f60
-
SHA512
33f24f25ccd5aba2b887b779514ce67e06069866f230fa9cf8f1fc767dd6c0a630d35456d76c0530abc8ec95c413b5218234cebc35170c9024b0bf4e34ec2672
-
SSDEEP
12288:EMr8y90rfhUZ+Ab2tgU7BhJ8aIN+TKwniClZunrFzb0bjls9reP3By0GpaLi:IycgJ2/b8VoTKvyZuntb0mIRDJi
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-