General
-
Target
7363af7b885b400a48d82ecf748b5917f4a6d5c9f215a1babf493e6bdcecba9c
-
Size
990KB
-
Sample
230411-pgt1lacc93
-
MD5
b391b9f06235f45c686fe4969f1c1cce
-
SHA1
7341362c57a949170b16d378d9597291af1a1c42
-
SHA256
7363af7b885b400a48d82ecf748b5917f4a6d5c9f215a1babf493e6bdcecba9c
-
SHA512
4fbbfddfd17c1b17c660cabed366530c4602404bba9596629c366d0d4b55c7091477e794c10344e17e1bf207d8c36d355158949bf04ee629e9dee48ae4e83b8b
-
SSDEEP
24576:gyPOfLKVaA5Ia2fO6Hz8+mcDB59HUwkOKl8WnKm:n/alff9TvmcDB8wkOKl
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
amadey
3.70
77.91.124.207/plays/chapter/index.php
Extracted
redline
maxi
185.161.248.90:4125
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Targets
-
-
Target
7363af7b885b400a48d82ecf748b5917f4a6d5c9f215a1babf493e6bdcecba9c
-
Size
990KB
-
MD5
b391b9f06235f45c686fe4969f1c1cce
-
SHA1
7341362c57a949170b16d378d9597291af1a1c42
-
SHA256
7363af7b885b400a48d82ecf748b5917f4a6d5c9f215a1babf493e6bdcecba9c
-
SHA512
4fbbfddfd17c1b17c660cabed366530c4602404bba9596629c366d0d4b55c7091477e794c10344e17e1bf207d8c36d355158949bf04ee629e9dee48ae4e83b8b
-
SSDEEP
24576:gyPOfLKVaA5Ia2fO6Hz8+mcDB59HUwkOKl8WnKm:n/alff9TvmcDB8wkOKl
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-