General
-
Target
7de8763fab3806767e0a1d0d10a4648753b53df35927de5d1695a9894df51c99
-
Size
1.2MB
-
Sample
230414-jkpx6aad8w
-
MD5
763688c3acca4c9a6c677fee9cc1ce79
-
SHA1
a0c5a924c8a81ee80e9ed6137de6a1b6ec5188a0
-
SHA256
7de8763fab3806767e0a1d0d10a4648753b53df35927de5d1695a9894df51c99
-
SHA512
808d560609db65140df36b71378ed7832a7db8852b3d8a2e19632d10f242b1c7faefbd750bd7d8319ac4564ff07f29043a5f0f353c90413c5e4fb80d5eee0c35
-
SSDEEP
24576:/yxkUrjIu0afnQYhaM4x61S74P82k8kYbwDB8k1J9N+oRoSb05+T92BQA/:KCUrjH0afnQ7KrbwDB8k1/YxSb0oci
Static task
static1
Malware Config
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
redline
disa
185.161.248.90:4125
-
auth_value
93f8c4ca7000e3381dd4b6b86434de05
Targets
-
-
Target
7de8763fab3806767e0a1d0d10a4648753b53df35927de5d1695a9894df51c99
-
Size
1.2MB
-
MD5
763688c3acca4c9a6c677fee9cc1ce79
-
SHA1
a0c5a924c8a81ee80e9ed6137de6a1b6ec5188a0
-
SHA256
7de8763fab3806767e0a1d0d10a4648753b53df35927de5d1695a9894df51c99
-
SHA512
808d560609db65140df36b71378ed7832a7db8852b3d8a2e19632d10f242b1c7faefbd750bd7d8319ac4564ff07f29043a5f0f353c90413c5e4fb80d5eee0c35
-
SSDEEP
24576:/yxkUrjIu0afnQYhaM4x61S74P82k8kYbwDB8k1J9N+oRoSb05+T92BQA/:KCUrjH0afnQ7KrbwDB8k1/YxSb0oci
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-