General
-
Target
d5eecc149047281a25575956b4af42f0fefd55e887c5caffa2157ecf9b8b78fc
-
Size
1.0MB
-
Sample
230414-kvd43shc43
-
MD5
07aa11a640b63de11d2a94ef5b24b9b8
-
SHA1
85100a108bfd20a77e2b91eaca36dff6aa4da08a
-
SHA256
d5eecc149047281a25575956b4af42f0fefd55e887c5caffa2157ecf9b8b78fc
-
SHA512
ecc5324d12bd7c8c0cb55dae7c0e5f0d78d502989557a7e338d0bee6c2bb9400fb1a0a73e32b1bb0000aa391bcfe87f6629fb74187661c20440c29d451c406aa
-
SSDEEP
24576:xyYNOXzBq6q/hSy1v9OyD7eGmSOAHGYGJKWl:k1U6qJSy1F9DbmSOTB
Static task
static1
Malware Config
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
redline
disa
185.161.248.90:4125
-
auth_value
93f8c4ca7000e3381dd4b6b86434de05
Targets
-
-
Target
d5eecc149047281a25575956b4af42f0fefd55e887c5caffa2157ecf9b8b78fc
-
Size
1.0MB
-
MD5
07aa11a640b63de11d2a94ef5b24b9b8
-
SHA1
85100a108bfd20a77e2b91eaca36dff6aa4da08a
-
SHA256
d5eecc149047281a25575956b4af42f0fefd55e887c5caffa2157ecf9b8b78fc
-
SHA512
ecc5324d12bd7c8c0cb55dae7c0e5f0d78d502989557a7e338d0bee6c2bb9400fb1a0a73e32b1bb0000aa391bcfe87f6629fb74187661c20440c29d451c406aa
-
SSDEEP
24576:xyYNOXzBq6q/hSy1v9OyD7eGmSOAHGYGJKWl:k1U6qJSy1F9DbmSOTB
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-