General
-
Target
0725f260ba19700d6e3ff691efa3f8787123613c5f57be0259e1e0b3b8001a93
-
Size
1.1MB
-
Sample
230411-pvp9kacd57
-
MD5
8ce730745ead454d166e19154d9b2c78
-
SHA1
108ae719def3f8cf57df18afa524a107de0881b2
-
SHA256
0725f260ba19700d6e3ff691efa3f8787123613c5f57be0259e1e0b3b8001a93
-
SHA512
245599de3f41642acf250c46374f10bc8985121f5ecaba775f96c8d868d60864c8b80e1454837ce5a33436056821b2e9d2979b3150c7ae03882e32c5a7219ac3
-
SSDEEP
24576:syCEzxBzTzcTHVcKQqLcM+/ng4+nrGO6AbbLd5JxtPk3fuGIGB:blBPzcbiKQWcMmLjAbbvJxtM3mGIG
Static task
static1
Malware Config
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
amadey
3.70
77.91.124.207/plays/chapter/index.php
Extracted
redline
maxi
185.161.248.90:4125
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Targets
-
-
Target
0725f260ba19700d6e3ff691efa3f8787123613c5f57be0259e1e0b3b8001a93
-
Size
1.1MB
-
MD5
8ce730745ead454d166e19154d9b2c78
-
SHA1
108ae719def3f8cf57df18afa524a107de0881b2
-
SHA256
0725f260ba19700d6e3ff691efa3f8787123613c5f57be0259e1e0b3b8001a93
-
SHA512
245599de3f41642acf250c46374f10bc8985121f5ecaba775f96c8d868d60864c8b80e1454837ce5a33436056821b2e9d2979b3150c7ae03882e32c5a7219ac3
-
SSDEEP
24576:syCEzxBzTzcTHVcKQqLcM+/ng4+nrGO6AbbLd5JxtPk3fuGIGB:blBPzcbiKQWcMmLjAbbvJxtM3mGIG
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-