General
-
Target
0x0008000000013347-68.dat
-
Size
170KB
-
Sample
230503-vzyz6ahe5v
-
MD5
811a39411f3e51bc1d4c88ef4a45c605
-
SHA1
d8e4d044d3eba56831191807797058ae034c956a
-
SHA256
52905ea3524de76754b3082e250ef7badcf878b8fba258539c8b2d427c3808d3
-
SHA512
31a263acfb3e1431ce40ba8d784d2dcbdb34b0eba9725a78c5816434ec8472164b3e6ad2c9ea9747056db1d1567a0ec0dc6975ede5264f7962dea3ecc94dd36a
-
SSDEEP
1536:TyqlwNqlVZRGWY8HrIGtRSotDaZIPeKNDETGqVqbuFz1CSwx83wYk/8e8hR:Th6D3GtzD263qVeUESwx58e8hR
Behavioral task
behavioral1
Sample
0x0008000000013347-68.exe
Resource
win7-20230220-en
Malware Config
Extracted
redline
diza
217.196.96.56:4138
-
auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80
Targets
-
-
Target
0x0008000000013347-68.dat
-
Size
170KB
-
MD5
811a39411f3e51bc1d4c88ef4a45c605
-
SHA1
d8e4d044d3eba56831191807797058ae034c956a
-
SHA256
52905ea3524de76754b3082e250ef7badcf878b8fba258539c8b2d427c3808d3
-
SHA512
31a263acfb3e1431ce40ba8d784d2dcbdb34b0eba9725a78c5816434ec8472164b3e6ad2c9ea9747056db1d1567a0ec0dc6975ede5264f7962dea3ecc94dd36a
-
SSDEEP
1536:TyqlwNqlVZRGWY8HrIGtRSotDaZIPeKNDETGqVqbuFz1CSwx83wYk/8e8hR:Th6D3GtzD263qVeUESwx58e8hR
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-