General
-
Target
8ff7ae60d08287d32284ec31e27102989ea147c467c797fe54acbc0cb0df8380
-
Size
924KB
-
Sample
230409-yzvjhsch49
-
MD5
9070b31a4ea6570216ee5d0758f05cc4
-
SHA1
a0431611f84591448c34c83aed8503295e4103f7
-
SHA256
8ff7ae60d08287d32284ec31e27102989ea147c467c797fe54acbc0cb0df8380
-
SHA512
6aaa0ea5b73ed0337bf5a1c6175c023924e1fdaf158f30f123f5b2b4fe0b934e5aa5022787cdcffd92b7d29fd7f7a4878f2e18fae591b894e9930f15682a6942
-
SSDEEP
24576:myrHSY7ddQdW5rLOQx+Nl4yJ920CyR2XT:1eyddd5vcNZ920CyR2
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Targets
-
-
Target
8ff7ae60d08287d32284ec31e27102989ea147c467c797fe54acbc0cb0df8380
-
Size
924KB
-
MD5
9070b31a4ea6570216ee5d0758f05cc4
-
SHA1
a0431611f84591448c34c83aed8503295e4103f7
-
SHA256
8ff7ae60d08287d32284ec31e27102989ea147c467c797fe54acbc0cb0df8380
-
SHA512
6aaa0ea5b73ed0337bf5a1c6175c023924e1fdaf158f30f123f5b2b4fe0b934e5aa5022787cdcffd92b7d29fd7f7a4878f2e18fae591b894e9930f15682a6942
-
SSDEEP
24576:myrHSY7ddQdW5rLOQx+Nl4yJ920CyR2XT:1eyddd5vcNZ920CyR2
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-