General
-
Target
bf1ba9aef4951a8c72db26b0d46bce7a2ac05e1d883d5016795126e88f40f4fc
-
Size
940KB
-
Sample
230410-yysnjaga36
-
MD5
9ff68422844d814b87ec6c6bdcf463e6
-
SHA1
7a0557d99fb30e7e17fb0e65fa1d87599b9bbc42
-
SHA256
bf1ba9aef4951a8c72db26b0d46bce7a2ac05e1d883d5016795126e88f40f4fc
-
SHA512
82d438b6cc9bddadc4c6e6bd2e28460f5c922788b311b73f7abe3a555bac7f8aae9fede83c81b780cb644a831faa2fc30e8f575270b47ac51aa76cb28a9123b4
-
SSDEEP
12288:FMray90ncPRDoT3uTuM+81SP21D8A6zKrClQIf9QO14EFtZ1zfbNotx9v0ZK6yD:LyvtEeTuZnzXzvlQIfz1lFBBo/yZK/
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Targets
-
-
Target
bf1ba9aef4951a8c72db26b0d46bce7a2ac05e1d883d5016795126e88f40f4fc
-
Size
940KB
-
MD5
9ff68422844d814b87ec6c6bdcf463e6
-
SHA1
7a0557d99fb30e7e17fb0e65fa1d87599b9bbc42
-
SHA256
bf1ba9aef4951a8c72db26b0d46bce7a2ac05e1d883d5016795126e88f40f4fc
-
SHA512
82d438b6cc9bddadc4c6e6bd2e28460f5c922788b311b73f7abe3a555bac7f8aae9fede83c81b780cb644a831faa2fc30e8f575270b47ac51aa76cb28a9123b4
-
SSDEEP
12288:FMray90ncPRDoT3uTuM+81SP21D8A6zKrClQIf9QO14EFtZ1zfbNotx9v0ZK6yD:LyvtEeTuZnzXzvlQIfz1lFBBo/yZK/
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-