General
-
Target
071e796bd4889502ce361eaf381c69fe1edc180e19d985bf4ee5ae17dd53dcc6
-
Size
992KB
-
Sample
230411-pd1c7sea4z
-
MD5
19e0cf316a839b4c39227a4b112b5a25
-
SHA1
769735c09e26c6eb598fc322cdd0d41d5ebf0e19
-
SHA256
071e796bd4889502ce361eaf381c69fe1edc180e19d985bf4ee5ae17dd53dcc6
-
SHA512
8c488397827a50c36d8606f5c79d80322ddff46715e92eb8754f4c18c7ad50685250d00c24e919cad133764fcaf113aa014f6d6f25a2a9fd9198457a2a9eb6df
-
SSDEEP
24576:dywbcE5m+6z0lZujycDIItIHDFwstS7TPKOuTFi:4Krm9n2ucDFcfJuTF
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
amadey
3.70
77.91.124.207/plays/chapter/index.php
Extracted
redline
maxi
185.161.248.90:4125
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Targets
-
-
Target
071e796bd4889502ce361eaf381c69fe1edc180e19d985bf4ee5ae17dd53dcc6
-
Size
992KB
-
MD5
19e0cf316a839b4c39227a4b112b5a25
-
SHA1
769735c09e26c6eb598fc322cdd0d41d5ebf0e19
-
SHA256
071e796bd4889502ce361eaf381c69fe1edc180e19d985bf4ee5ae17dd53dcc6
-
SHA512
8c488397827a50c36d8606f5c79d80322ddff46715e92eb8754f4c18c7ad50685250d00c24e919cad133764fcaf113aa014f6d6f25a2a9fd9198457a2a9eb6df
-
SSDEEP
24576:dywbcE5m+6z0lZujycDIItIHDFwstS7TPKOuTFi:4Krm9n2ucDFcfJuTF
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-