General
-
Target
f582a0b7b7995fc2f7d4bbcf0d55368e8336fb33ac079476750476a68de57b65
-
Size
981KB
-
Sample
230411-mncc1sbh53
-
MD5
12af93647597b29ffd8d196cd272a056
-
SHA1
b6c2b0c8e9fe5e200e7b7e2a19270eff164af1ad
-
SHA256
f582a0b7b7995fc2f7d4bbcf0d55368e8336fb33ac079476750476a68de57b65
-
SHA512
da862adbc2933e312f13cc0ec90ab191c103f3e15391e95ee1b60061d334da02f7d8169c2aa77fc6cbc057f6bde02b4702f6cbb72196662077174f8957f1081d
-
SSDEEP
24576:eyqcqISQxlbrmkrJRaFoT/tldDmxE7k/K3tLBt:ttqILPfmkrJRD/JrgEL
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
amadey
3.70
77.91.124.207/plays/chapter/index.php
Extracted
redline
nord
176.113.115.145:4125
-
auth_value
ebb7d38cdbd7c83cf6363ef3feb3a530
Targets
-
-
Target
f582a0b7b7995fc2f7d4bbcf0d55368e8336fb33ac079476750476a68de57b65
-
Size
981KB
-
MD5
12af93647597b29ffd8d196cd272a056
-
SHA1
b6c2b0c8e9fe5e200e7b7e2a19270eff164af1ad
-
SHA256
f582a0b7b7995fc2f7d4bbcf0d55368e8336fb33ac079476750476a68de57b65
-
SHA512
da862adbc2933e312f13cc0ec90ab191c103f3e15391e95ee1b60061d334da02f7d8169c2aa77fc6cbc057f6bde02b4702f6cbb72196662077174f8957f1081d
-
SSDEEP
24576:eyqcqISQxlbrmkrJRaFoT/tldDmxE7k/K3tLBt:ttqILPfmkrJRD/JrgEL
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-