General
-
Target
c66afa763c7b2b925cfd5b7d8b8595ebeee2b7bad04bf75b89f9c7845618e049
-
Size
939KB
-
Sample
230410-y8mj9sga77
-
MD5
e400cf4aeaa7c43e6af6ec86e6e6f97b
-
SHA1
ed503cbe9b802be062578f96f53caf173eb79e73
-
SHA256
c66afa763c7b2b925cfd5b7d8b8595ebeee2b7bad04bf75b89f9c7845618e049
-
SHA512
21e01fb7df2b62d87f5ab57b0b5f9db211c9f4f187a996facea9549f98f9c8a3d51dac473408038c0d404d9d685e251e58a9e1481a313b5e3e5638b63fcc2648
-
SSDEEP
24576:+yi85F3VWPWE+Jf/ANAq1z2/b+3d/I7rkDfc0cy3trtMI1gB7:Ni8ncWE+Jf/ASN/b+RbfWydrjO
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Targets
-
-
Target
c66afa763c7b2b925cfd5b7d8b8595ebeee2b7bad04bf75b89f9c7845618e049
-
Size
939KB
-
MD5
e400cf4aeaa7c43e6af6ec86e6e6f97b
-
SHA1
ed503cbe9b802be062578f96f53caf173eb79e73
-
SHA256
c66afa763c7b2b925cfd5b7d8b8595ebeee2b7bad04bf75b89f9c7845618e049
-
SHA512
21e01fb7df2b62d87f5ab57b0b5f9db211c9f4f187a996facea9549f98f9c8a3d51dac473408038c0d404d9d685e251e58a9e1481a313b5e3e5638b63fcc2648
-
SSDEEP
24576:+yi85F3VWPWE+Jf/ANAq1z2/b+3d/I7rkDfc0cy3trtMI1gB7:Ni8ncWE+Jf/ASN/b+RbfWydrjO
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-