General
-
Target
921591e939de49f1fee61ed681f27aa9e63492a62dc851efb25a0d07ea2534cf
-
Size
991KB
-
Sample
230411-zjjmragh7w
-
MD5
dc0e4783e8ed60a0ef9fca56f5344834
-
SHA1
9e5e0acf4015a6f017d3fa6a5eb88b0445eace49
-
SHA256
921591e939de49f1fee61ed681f27aa9e63492a62dc851efb25a0d07ea2534cf
-
SHA512
4b86ae0d7b86c903ae20ee30db934d1bc297ec88b5ac73f62a8a0b3f4bce3281f3354629b460497b48079c22ab2fec13c49a3d7c1737ea34f53b54496219de2d
-
SSDEEP
24576:By89o1iRUkf0z0PxBXgdIoFAcdTLV4WfsqBJb/K:08m1ZiBXgtAchLe+HLb
Static task
static1
Malware Config
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
redline
diza
185.161.248.90:4125
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Extracted
amadey
3.70
193.201.9.43/plays/chapter/index.php
Targets
-
-
Target
921591e939de49f1fee61ed681f27aa9e63492a62dc851efb25a0d07ea2534cf
-
Size
991KB
-
MD5
dc0e4783e8ed60a0ef9fca56f5344834
-
SHA1
9e5e0acf4015a6f017d3fa6a5eb88b0445eace49
-
SHA256
921591e939de49f1fee61ed681f27aa9e63492a62dc851efb25a0d07ea2534cf
-
SHA512
4b86ae0d7b86c903ae20ee30db934d1bc297ec88b5ac73f62a8a0b3f4bce3281f3354629b460497b48079c22ab2fec13c49a3d7c1737ea34f53b54496219de2d
-
SSDEEP
24576:By89o1iRUkf0z0PxBXgdIoFAcdTLV4WfsqBJb/K:08m1ZiBXgtAchLe+HLb
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-