General
-
Target
8c9b35a9e488358eb87e36f17c2eed2707c501708ede5c46034d56819a94b45d
-
Size
939KB
-
Sample
230410-zaf59sga96
-
MD5
7d16f68f4c11df702ee313df9d56f10a
-
SHA1
42698674aae50c34819f6b67501c389ac8448d86
-
SHA256
8c9b35a9e488358eb87e36f17c2eed2707c501708ede5c46034d56819a94b45d
-
SHA512
a7200f0eaf1cbc72fb1cf0defd93f0f26345a5332a40e4be1788879108f0efde5895087aefe522ffadeaf093628c2461767d8c655c4bb820692d026592cea5bd
-
SSDEEP
24576:syxt6hI4zXffcokvwvU/Uy3cI3E+BIv3XGQE:bxtT0nCvws/UnL+2v3XGQ
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Targets
-
-
Target
8c9b35a9e488358eb87e36f17c2eed2707c501708ede5c46034d56819a94b45d
-
Size
939KB
-
MD5
7d16f68f4c11df702ee313df9d56f10a
-
SHA1
42698674aae50c34819f6b67501c389ac8448d86
-
SHA256
8c9b35a9e488358eb87e36f17c2eed2707c501708ede5c46034d56819a94b45d
-
SHA512
a7200f0eaf1cbc72fb1cf0defd93f0f26345a5332a40e4be1788879108f0efde5895087aefe522ffadeaf093628c2461767d8c655c4bb820692d026592cea5bd
-
SSDEEP
24576:syxt6hI4zXffcokvwvU/Uy3cI3E+BIv3XGQE:bxtT0nCvws/UnL+2v3XGQ
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-