General
-
Target
9d8a58eb57dc17127c1bddb783b32f9765c44960989d998fd087c1d3e2473cc5
-
Size
801KB
-
Sample
230410-z7ecyahh4t
-
MD5
fa02a25d98be47f51c6f07d5d2043797
-
SHA1
58342b20c10146cd22907a071e3d77505f2e4ec0
-
SHA256
9d8a58eb57dc17127c1bddb783b32f9765c44960989d998fd087c1d3e2473cc5
-
SHA512
6d2156fcc5ce23ccab757d89c3130e56167cc0a4e81d4ae64c06c4b9ee9d703f797c8d49812ea9b28d52b511c09d1d6b2750117bb853732fddb36afbf43e9e69
-
SSDEEP
12288:pMrBfy90ZV9MV8ENZxBuLzEaX+PxK7ClsRWzdyHBNaxwHjK05URbqfJzzaq:6fyWCK4ZxBun/XyxfSWzdKhjKnx4Jz
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Targets
-
-
Target
9d8a58eb57dc17127c1bddb783b32f9765c44960989d998fd087c1d3e2473cc5
-
Size
801KB
-
MD5
fa02a25d98be47f51c6f07d5d2043797
-
SHA1
58342b20c10146cd22907a071e3d77505f2e4ec0
-
SHA256
9d8a58eb57dc17127c1bddb783b32f9765c44960989d998fd087c1d3e2473cc5
-
SHA512
6d2156fcc5ce23ccab757d89c3130e56167cc0a4e81d4ae64c06c4b9ee9d703f797c8d49812ea9b28d52b511c09d1d6b2750117bb853732fddb36afbf43e9e69
-
SSDEEP
12288:pMrBfy90ZV9MV8ENZxBuLzEaX+PxK7ClsRWzdyHBNaxwHjK05URbqfJzzaq:6fyWCK4ZxBun/XyxfSWzdKhjKnx4Jz
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-