General
-
Target
148b2f672caf1dc0069ef705081ad51c48124046b7a1312d3827e2c1661b9699
-
Size
939KB
-
Sample
230410-ybqweshd4s
-
MD5
e7be561084c08ab7c1c66eadc74138e4
-
SHA1
5c80ea4a4915b335d552f9332c45ec8263f63ff4
-
SHA256
148b2f672caf1dc0069ef705081ad51c48124046b7a1312d3827e2c1661b9699
-
SHA512
8ec4d0518a3e87dbb067a2fe53615d6abdf6a13d73a48f1f6ad99f53a5427dc4daf0ffc81bd83d800143dc7f6d6bcfb24fb7a2f1adb0824e98f096ecedbe3fa8
-
SSDEEP
24576:KyOt3S09cxnqd9hgNcPzf8PI3/ZkqZQe:ROsCYn8OcPzKyiqZQ
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Targets
-
-
Target
148b2f672caf1dc0069ef705081ad51c48124046b7a1312d3827e2c1661b9699
-
Size
939KB
-
MD5
e7be561084c08ab7c1c66eadc74138e4
-
SHA1
5c80ea4a4915b335d552f9332c45ec8263f63ff4
-
SHA256
148b2f672caf1dc0069ef705081ad51c48124046b7a1312d3827e2c1661b9699
-
SHA512
8ec4d0518a3e87dbb067a2fe53615d6abdf6a13d73a48f1f6ad99f53a5427dc4daf0ffc81bd83d800143dc7f6d6bcfb24fb7a2f1adb0824e98f096ecedbe3fa8
-
SSDEEP
24576:KyOt3S09cxnqd9hgNcPzf8PI3/ZkqZQe:ROsCYn8OcPzKyiqZQ
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-