General
-
Target
e616755f8b43d52a7e08b98c3aa2f8b47843dc97307162ee7d61bdc86d0aeb3f
-
Size
982KB
-
Sample
230411-ne7y1aca86
-
MD5
d220d64259466db0379dd82cac646d89
-
SHA1
72a8f7171288f9af31e2f1cb44ba318eb1531887
-
SHA256
e616755f8b43d52a7e08b98c3aa2f8b47843dc97307162ee7d61bdc86d0aeb3f
-
SHA512
31486024ac045a25d07ed859ae7838281f648188636bffaeab25d96e7f4f4e457641160ad9a80a61830e58a5d20cc678e9523cb3e472569a2f099c08ef3ac6f5
-
SSDEEP
24576:GywiI3qqHaishQuBy8ZgdZ7afqDPx4g7de9NjnG0pVOGX:Vwiwq9a8ZgdZ2eFMnG4VO
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
amadey
3.70
77.91.124.207/plays/chapter/index.php
Extracted
redline
nord
176.113.115.145:4125
-
auth_value
ebb7d38cdbd7c83cf6363ef3feb3a530
Targets
-
-
Target
e616755f8b43d52a7e08b98c3aa2f8b47843dc97307162ee7d61bdc86d0aeb3f
-
Size
982KB
-
MD5
d220d64259466db0379dd82cac646d89
-
SHA1
72a8f7171288f9af31e2f1cb44ba318eb1531887
-
SHA256
e616755f8b43d52a7e08b98c3aa2f8b47843dc97307162ee7d61bdc86d0aeb3f
-
SHA512
31486024ac045a25d07ed859ae7838281f648188636bffaeab25d96e7f4f4e457641160ad9a80a61830e58a5d20cc678e9523cb3e472569a2f099c08ef3ac6f5
-
SSDEEP
24576:GywiI3qqHaishQuBy8ZgdZ7afqDPx4g7de9NjnG0pVOGX:Vwiwq9a8ZgdZ2eFMnG4VO
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-