General
-
Target
8f0a645a6c8a5319f538ea5ccc3bccad63cce55c67cda90757aeec699ddf0f3c
-
Size
843KB
-
Sample
230411-m25xgsdf7v
-
MD5
0916569054291b140e81b4d91cb0c511
-
SHA1
a56095aaa03cc684b775c4eb4cdf48b197dd006e
-
SHA256
8f0a645a6c8a5319f538ea5ccc3bccad63cce55c67cda90757aeec699ddf0f3c
-
SHA512
7339bd8572fcca2f1e778d2f393bd3d680071dd6d1912d6c8d30a87f0f3d032ff8a0f4c5256f4cc62780926b439f72cc1324c293836159a7b9f9d01394d53e50
-
SSDEEP
24576:Xys3/doLfwM4EYw4QCrX7Yduc2Mzi/Bmb8IaPfwP:iXfwMmwb1zWBmAIew
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
nahui
176.113.115.145:4125
-
auth_value
b9ed10946d21e28d58d0c72c535cde6f
Extracted
amadey
3.70
77.91.124.207/plays/chapter/index.php
Targets
-
-
Target
8f0a645a6c8a5319f538ea5ccc3bccad63cce55c67cda90757aeec699ddf0f3c
-
Size
843KB
-
MD5
0916569054291b140e81b4d91cb0c511
-
SHA1
a56095aaa03cc684b775c4eb4cdf48b197dd006e
-
SHA256
8f0a645a6c8a5319f538ea5ccc3bccad63cce55c67cda90757aeec699ddf0f3c
-
SHA512
7339bd8572fcca2f1e778d2f393bd3d680071dd6d1912d6c8d30a87f0f3d032ff8a0f4c5256f4cc62780926b439f72cc1324c293836159a7b9f9d01394d53e50
-
SSDEEP
24576:Xys3/doLfwM4EYw4QCrX7Yduc2Mzi/Bmb8IaPfwP:iXfwMmwb1zWBmAIew
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-