General
-
Target
3304e13d59b8e484ea2eb7704d848a1808b6ebe4306f1f2a7207297126327b2b
-
Size
843KB
-
Sample
230411-ml1b3ade81
-
MD5
ee57e3eb5044334879e7a5c63978f849
-
SHA1
986edfbb2e560a665e156aba0087bf1da96dffad
-
SHA256
3304e13d59b8e484ea2eb7704d848a1808b6ebe4306f1f2a7207297126327b2b
-
SHA512
974a8483de21626b4b2ac6d406f9aefeda344f7f6f80de6751b334c81ef1e3989fc3a2fa6a4300944e40531d2fe18c219a903da506dc00bf38522b87c9a9f041
-
SSDEEP
24576:cyvJSzzwac+i6rvwt4Qo8iVCHwrZ3ESwuH0BJ0wY:LvKRc+iwyHwrRp0vf
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
nahui
176.113.115.145:4125
-
auth_value
b9ed10946d21e28d58d0c72c535cde6f
Extracted
amadey
3.70
77.91.124.207/plays/chapter/index.php
Targets
-
-
Target
3304e13d59b8e484ea2eb7704d848a1808b6ebe4306f1f2a7207297126327b2b
-
Size
843KB
-
MD5
ee57e3eb5044334879e7a5c63978f849
-
SHA1
986edfbb2e560a665e156aba0087bf1da96dffad
-
SHA256
3304e13d59b8e484ea2eb7704d848a1808b6ebe4306f1f2a7207297126327b2b
-
SHA512
974a8483de21626b4b2ac6d406f9aefeda344f7f6f80de6751b334c81ef1e3989fc3a2fa6a4300944e40531d2fe18c219a903da506dc00bf38522b87c9a9f041
-
SSDEEP
24576:cyvJSzzwac+i6rvwt4Qo8iVCHwrZ3ESwuH0BJ0wY:LvKRc+iwyHwrRp0vf
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-