General
-
Target
97f18b53feba5e7118f5113c8a337ac170a5c74d71cfa1e5945d2371b61d56d7
-
Size
1.0MB
-
Sample
230410-y7eg9shf3z
-
MD5
7f3ff11182d8df0329e96c2a08b2ea35
-
SHA1
1a2a40032563da3f723e1d40c1d012099cc8b3c1
-
SHA256
97f18b53feba5e7118f5113c8a337ac170a5c74d71cfa1e5945d2371b61d56d7
-
SHA512
2c51564adf6dcb5c2dfb00ddf001a7a30a2b3a410fc1dd3e6c1bd0e83ebcea2d538d43c0a40453b9f3368a48a5d1a8c8fd97c4a36255372144432302029942c8
-
SSDEEP
24576:ay5yRNpOACS4ltaoaw9pwufHOnI5zTizuX27/M8xfx:hiOSYtaoawHzfR5Xmx
Static task
static1
Malware Config
Extracted
amadey
3.70
77.91.124.207/plays/chapter/index.php
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
brat
176.113.115.145:4125
-
auth_value
1f9c658aed2f70f42f99a57a005561cf
Targets
-
-
Target
97f18b53feba5e7118f5113c8a337ac170a5c74d71cfa1e5945d2371b61d56d7
-
Size
1.0MB
-
MD5
7f3ff11182d8df0329e96c2a08b2ea35
-
SHA1
1a2a40032563da3f723e1d40c1d012099cc8b3c1
-
SHA256
97f18b53feba5e7118f5113c8a337ac170a5c74d71cfa1e5945d2371b61d56d7
-
SHA512
2c51564adf6dcb5c2dfb00ddf001a7a30a2b3a410fc1dd3e6c1bd0e83ebcea2d538d43c0a40453b9f3368a48a5d1a8c8fd97c4a36255372144432302029942c8
-
SSDEEP
24576:ay5yRNpOACS4ltaoaw9pwufHOnI5zTizuX27/M8xfx:hiOSYtaoawHzfR5Xmx
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-