General
-
Target
2f7dd6c90c88679c7889428866f1a9ac4a50f91235b9b4f4fa1975916d9044ad
-
Size
940KB
-
Sample
230410-ynzzvshd9x
-
MD5
c1f741b68def6667ec44e12f04522e97
-
SHA1
eb0afb5b6c6895ff5999261201cda2ed58d9e5b4
-
SHA256
2f7dd6c90c88679c7889428866f1a9ac4a50f91235b9b4f4fa1975916d9044ad
-
SHA512
9e677f59ebef55a4b8751b329b7363f73711648555b90c401e8bf90e6a2bea8b4f7ac1cd132b3d9ec197128ce9a3da06a7b0df016e7aa8fa7049061a6af1946b
-
SSDEEP
24576:yyH0fjolOQVj3be1GCQH7+WyNIX3dgFMNGm2c:ZHEolO43btl+L2dgFMNGm2
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Targets
-
-
Target
2f7dd6c90c88679c7889428866f1a9ac4a50f91235b9b4f4fa1975916d9044ad
-
Size
940KB
-
MD5
c1f741b68def6667ec44e12f04522e97
-
SHA1
eb0afb5b6c6895ff5999261201cda2ed58d9e5b4
-
SHA256
2f7dd6c90c88679c7889428866f1a9ac4a50f91235b9b4f4fa1975916d9044ad
-
SHA512
9e677f59ebef55a4b8751b329b7363f73711648555b90c401e8bf90e6a2bea8b4f7ac1cd132b3d9ec197128ce9a3da06a7b0df016e7aa8fa7049061a6af1946b
-
SSDEEP
24576:yyH0fjolOQVj3be1GCQH7+WyNIX3dgFMNGm2c:ZHEolO43btl+L2dgFMNGm2
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-