General
-
Target
3a4ce9fa246924bc049d37e077d35874ea6806845a0cb.exe
-
Size
535KB
-
Sample
230412-wwfvvaea75
-
MD5
57fec1386f335f711eb261a273860385
-
SHA1
edea4c56a72197822e9048a5a8142272f1710854
-
SHA256
3a4ce9fa246924bc049d37e077d35874ea6806845a0cb512139df90a1bbe0562
-
SHA512
603baad7f1472b2e3d68f275eaf43470200021a6d609e6c7f35351014156ce876c3aa7b86fc5bf44af42dc67357c1aef236436ce386a66d1d28da3b0ff145f9c
-
SSDEEP
12288:+Mrcy90EEojf44o9rWfr/xK7C0G0ZeztpytYqJyBN+tG+j:2yDRs/wxfkuw7JJ7j
Static task
static1
Behavioral task
behavioral1
Sample
3a4ce9fa246924bc049d37e077d35874ea6806845a0cb.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3a4ce9fa246924bc049d37e077d35874ea6806845a0cb.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Targets
-
-
Target
3a4ce9fa246924bc049d37e077d35874ea6806845a0cb.exe
-
Size
535KB
-
MD5
57fec1386f335f711eb261a273860385
-
SHA1
edea4c56a72197822e9048a5a8142272f1710854
-
SHA256
3a4ce9fa246924bc049d37e077d35874ea6806845a0cb512139df90a1bbe0562
-
SHA512
603baad7f1472b2e3d68f275eaf43470200021a6d609e6c7f35351014156ce876c3aa7b86fc5bf44af42dc67357c1aef236436ce386a66d1d28da3b0ff145f9c
-
SSDEEP
12288:+Mrcy90EEojf44o9rWfr/xK7C0G0ZeztpytYqJyBN+tG+j:2yDRs/wxfkuw7JJ7j
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-