General
-
Target
7050898ff74b519340b940d11db1c5e99e35a0c2e07ac67a5b4072cb7d07adf8
-
Size
939KB
-
Sample
230410-y7n2pshf31
-
MD5
b38ab5aad5ca1e731a84a0130f8d038e
-
SHA1
192af73463cec39484cfe09fe03193e07e0e3f4b
-
SHA256
7050898ff74b519340b940d11db1c5e99e35a0c2e07ac67a5b4072cb7d07adf8
-
SHA512
9c7bcc168e58445d2eec10b3c48886a75eef33e22bba238b9ca8c947b8e2f55556005909c50c9f91103c4137b95b3abc865fd77b7f8dd573cbe84ce06523b241
-
SSDEEP
24576:CyAvDpkI5ISzX20W6xQk6Pvv4whoI0VPvf//I:pAvD62rygavv4NrvP
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Targets
-
-
Target
7050898ff74b519340b940d11db1c5e99e35a0c2e07ac67a5b4072cb7d07adf8
-
Size
939KB
-
MD5
b38ab5aad5ca1e731a84a0130f8d038e
-
SHA1
192af73463cec39484cfe09fe03193e07e0e3f4b
-
SHA256
7050898ff74b519340b940d11db1c5e99e35a0c2e07ac67a5b4072cb7d07adf8
-
SHA512
9c7bcc168e58445d2eec10b3c48886a75eef33e22bba238b9ca8c947b8e2f55556005909c50c9f91103c4137b95b3abc865fd77b7f8dd573cbe84ce06523b241
-
SSDEEP
24576:CyAvDpkI5ISzX20W6xQk6Pvv4whoI0VPvf//I:pAvD62rygavv4NrvP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-