General
-
Target
7ccfe5db7a804d41181351fea51317adb6ed7eb51dc9eb458d527abc124a8474
-
Size
1.0MB
-
Sample
230414-kxehmahc55
-
MD5
2f26aa3f89426a5e36747757afaf0477
-
SHA1
5b324867259bcd41991c8c98ba235dd339ce1167
-
SHA256
7ccfe5db7a804d41181351fea51317adb6ed7eb51dc9eb458d527abc124a8474
-
SHA512
14740ab0715697bf97f2e5582f98f4dd62cbfafbce0dfa3fb0e51400a22c6d466a44a5eebdb10ea5a349ed2ee58072903654a69b1e98e41d289d25f4be7f7e72
-
SSDEEP
24576:fyYEAJGv4zcn7ZzhI1M9Wimq6NikX1zYMM:qY0t7ZzhI1IJZ6JFZ
Static task
static1
Malware Config
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
redline
disa
185.161.248.90:4125
-
auth_value
93f8c4ca7000e3381dd4b6b86434de05
Targets
-
-
Target
7ccfe5db7a804d41181351fea51317adb6ed7eb51dc9eb458d527abc124a8474
-
Size
1.0MB
-
MD5
2f26aa3f89426a5e36747757afaf0477
-
SHA1
5b324867259bcd41991c8c98ba235dd339ce1167
-
SHA256
7ccfe5db7a804d41181351fea51317adb6ed7eb51dc9eb458d527abc124a8474
-
SHA512
14740ab0715697bf97f2e5582f98f4dd62cbfafbce0dfa3fb0e51400a22c6d466a44a5eebdb10ea5a349ed2ee58072903654a69b1e98e41d289d25f4be7f7e72
-
SSDEEP
24576:fyYEAJGv4zcn7ZzhI1M9Wimq6NikX1zYMM:qY0t7ZzhI1IJZ6JFZ
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-