General
-
Target
82520196e818fd18cacc30f0e3cc25f1.bin
-
Size
1.2MB
-
Sample
230412-dkgnwsah4v
-
MD5
cb24a11b70f162b2674ddb5139ef040e
-
SHA1
4a0aeb5a63d8ded5a4a5f3ef4473ce3c33bdb52b
-
SHA256
05c361ecdda075185e5ce69d3c3661454cac5d36df8e81b31a5bf4ac7dcf4a9e
-
SHA512
27fc6c60dc9208e7205bc6b4775692e972c946dae5808adde194ecb853df8b72561fd791a8c9fd12e7cbe47ace0614b4653d0416c3e42b2dd52a52430f5d1bd6
-
SSDEEP
24576:Bab3Z4t7PxzavcsbN6y1FrGQ0eQGS7NHUyZmpjwL5lAL6iwIkiX:Bq3it7PYvhbN6y3l0sKeGG4lVif
Static task
static1
Behavioral task
behavioral1
Sample
496e757aafe47554608c81d4c61815874da4f3350b6150e789a7fc5b3f35efe6.exe
Resource
win7-20230220-en
Malware Config
Extracted
amadey
3.70
77.91.124.207/plays/chapter/index.php
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
brat
176.113.115.145:4125
-
auth_value
1f9c658aed2f70f42f99a57a005561cf
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
redline
diza
185.161.248.90:4125
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Targets
-
-
Target
496e757aafe47554608c81d4c61815874da4f3350b6150e789a7fc5b3f35efe6.exe
-
Size
1.2MB
-
MD5
82520196e818fd18cacc30f0e3cc25f1
-
SHA1
45306110698d8fead529fa2a6d4773297e213452
-
SHA256
496e757aafe47554608c81d4c61815874da4f3350b6150e789a7fc5b3f35efe6
-
SHA512
e7d0819f7bb63aa8f7edbe2a7df7c6d2d14deec614e55596b49877e0b39c53b977cfd173471034d4ea3034113aef1083a07ce979d0cb2f014cc759ddb9a5a99f
-
SSDEEP
24576:Kyu38qhP7U/tDfMqMFfbUklGmqTljw2hhx3kSCjGdfgKLqIhXAuKWW:Ru38q17U1fMquzU4GmqhNDiSCAY7GXAX
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-