General
-
Target
aab0887da53df6c28fea944e7094352b53ff09514e3061272150058d6e6d8af9
-
Size
719KB
-
Sample
230411-pcaq6aea31
-
MD5
8c5162709f79ac0425ee7b2bfc6f0862
-
SHA1
1fa6f9bdc6b6725e9f9c044b88e505fe89a77f54
-
SHA256
aab0887da53df6c28fea944e7094352b53ff09514e3061272150058d6e6d8af9
-
SHA512
342de93f58a4127ace23521acb362ef2bad9591578bb24c8d6862b0ce917d3c001fac3d2d6193bd8e0af126b3b22594a7c8f878bc691e6f3afa5129c2af2e519
-
SSDEEP
12288:rMrzy90dZLZ3QJuTYgWTJ9JsTxnxMsVQ/Lydx59vjcat0NnR7y1zpQa1aEJKfS1L:AyQZOJu8gQJ6RV2yP59jD0nR8rpC+
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
diza
185.161.248.90:4125
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Extracted
amadey
3.70
77.91.124.207/plays/chapter/index.php
Targets
-
-
Target
aab0887da53df6c28fea944e7094352b53ff09514e3061272150058d6e6d8af9
-
Size
719KB
-
MD5
8c5162709f79ac0425ee7b2bfc6f0862
-
SHA1
1fa6f9bdc6b6725e9f9c044b88e505fe89a77f54
-
SHA256
aab0887da53df6c28fea944e7094352b53ff09514e3061272150058d6e6d8af9
-
SHA512
342de93f58a4127ace23521acb362ef2bad9591578bb24c8d6862b0ce917d3c001fac3d2d6193bd8e0af126b3b22594a7c8f878bc691e6f3afa5129c2af2e519
-
SSDEEP
12288:rMrzy90dZLZ3QJuTYgWTJ9JsTxnxMsVQ/Lydx59vjcat0NnR7y1zpQa1aEJKfS1L:AyQZOJu8gQJ6RV2yP59jD0nR8rpC+
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-