General
-
Target
ba3fa79a1ae70e21a020e94f1a52fea6437ae79f22aa589453e9509b2cfeae26
-
Size
992KB
-
Sample
230411-pkysysea7z
-
MD5
64e94461a26e44426cf5f37dc5c4135e
-
SHA1
404d4b46cb360674ffcbef9fa46b7cdf7b2ccc0e
-
SHA256
ba3fa79a1ae70e21a020e94f1a52fea6437ae79f22aa589453e9509b2cfeae26
-
SHA512
d294830cc10119b8d777a27502869bdd8b305b6b7f46e62c41f5a4593af8e6d4464bd0237e9bae2696d3b39c29a3f1b5b0f49d273d1329c2f2f36c6432c15cea
-
SSDEEP
24576:EyIGZMsnYVh3Ubnz+aJrY9Kl9JbZ0MwQxXMe0BCD8/os36XoJG3Mlb3:TI5sE3Uf+aJwKlSMpxXMehD8i4
Static task
static1
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
amadey
3.70
77.91.124.207/plays/chapter/index.php
Extracted
redline
maxi
185.161.248.90:4125
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Targets
-
-
Target
ba3fa79a1ae70e21a020e94f1a52fea6437ae79f22aa589453e9509b2cfeae26
-
Size
992KB
-
MD5
64e94461a26e44426cf5f37dc5c4135e
-
SHA1
404d4b46cb360674ffcbef9fa46b7cdf7b2ccc0e
-
SHA256
ba3fa79a1ae70e21a020e94f1a52fea6437ae79f22aa589453e9509b2cfeae26
-
SHA512
d294830cc10119b8d777a27502869bdd8b305b6b7f46e62c41f5a4593af8e6d4464bd0237e9bae2696d3b39c29a3f1b5b0f49d273d1329c2f2f36c6432c15cea
-
SSDEEP
24576:EyIGZMsnYVh3Ubnz+aJrY9Kl9JbZ0MwQxXMe0BCD8/os36XoJG3Mlb3:TI5sE3Uf+aJwKlSMpxXMehD8i4
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-