General
-
Target
3739050eb956cd1e34f730479bff3e5d8d85867833f5a603ea5f4a18f8d437fa
-
Size
981KB
-
Sample
230411-nrqkgsdg9v
-
MD5
35d575c1285507013aa3379d6e49d0f6
-
SHA1
213c4e47ee43d3b588e4e972370bf83c2f26423c
-
SHA256
3739050eb956cd1e34f730479bff3e5d8d85867833f5a603ea5f4a18f8d437fa
-
SHA512
be9d8fb5cafa3a53ad1e6aa08447fa6497781b8539ac513c5cbee1aedb692417a35515f14d37d5065a018f955e5612ef85eada2596b74cb21cee35976d4f3899
-
SSDEEP
24576:YyOTECdzMbQtaUwx21EnO68/qI74wJmmv8lVlaa:fqBdsQExx2uMRXLYV
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
amadey
3.70
77.91.124.207/plays/chapter/index.php
Extracted
redline
nord
176.113.115.145:4125
-
auth_value
ebb7d38cdbd7c83cf6363ef3feb3a530
Targets
-
-
Target
3739050eb956cd1e34f730479bff3e5d8d85867833f5a603ea5f4a18f8d437fa
-
Size
981KB
-
MD5
35d575c1285507013aa3379d6e49d0f6
-
SHA1
213c4e47ee43d3b588e4e972370bf83c2f26423c
-
SHA256
3739050eb956cd1e34f730479bff3e5d8d85867833f5a603ea5f4a18f8d437fa
-
SHA512
be9d8fb5cafa3a53ad1e6aa08447fa6497781b8539ac513c5cbee1aedb692417a35515f14d37d5065a018f955e5612ef85eada2596b74cb21cee35976d4f3899
-
SSDEEP
24576:YyOTECdzMbQtaUwx21EnO68/qI74wJmmv8lVlaa:fqBdsQExx2uMRXLYV
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-