General
-
Target
c21f059b9102f12d24a17d44b52df34f00e4a42f3502058bbf5cb7b6a16d1f15
-
Size
1.5MB
-
Sample
230414-fmkvfagc22
-
MD5
5d0a31e2e5f296d12b56732da4fa18c5
-
SHA1
28d61e08829fb73d59c9193049b1bf07664d6716
-
SHA256
c21f059b9102f12d24a17d44b52df34f00e4a42f3502058bbf5cb7b6a16d1f15
-
SHA512
e2f0e44ae5e2d6cb903b2228ffb3ec032098fc3729c229dfdfe7c7df72534ac2e9a1f65f45af35aea1f3265c292f105f3b4239563e403019d83557629d77912c
-
SSDEEP
49152:vwWkTyjoYGpj6SOHSEy0B/PRBXXrBb09:4WkejdeMyE15P/rBbi
Static task
static1
Malware Config
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
amadey
3.70
193.201.9.43/plays/chapter/index.php
Extracted
redline
masi
185.161.248.90:4125
-
auth_value
6e26457e57602c4cf35356c36d8dd8e8
Targets
-
-
Target
c21f059b9102f12d24a17d44b52df34f00e4a42f3502058bbf5cb7b6a16d1f15
-
Size
1.5MB
-
MD5
5d0a31e2e5f296d12b56732da4fa18c5
-
SHA1
28d61e08829fb73d59c9193049b1bf07664d6716
-
SHA256
c21f059b9102f12d24a17d44b52df34f00e4a42f3502058bbf5cb7b6a16d1f15
-
SHA512
e2f0e44ae5e2d6cb903b2228ffb3ec032098fc3729c229dfdfe7c7df72534ac2e9a1f65f45af35aea1f3265c292f105f3b4239563e403019d83557629d77912c
-
SSDEEP
49152:vwWkTyjoYGpj6SOHSEy0B/PRBXXrBb09:4WkejdeMyE15P/rBbi
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-