General
-
Target
0x000600000001ae8f-172.dat
-
Size
168KB
-
Sample
230506-sgxm9sbh6y
-
MD5
2227c129fb171681360f47431a2295ad
-
SHA1
aad96ffce1374e09052cf0603e7369773b78e4e5
-
SHA256
143618563b5ef3c6be00fd620f5b49b4f5a13eaa56b0cd22d59c375f5eba81a1
-
SHA512
f0e33daf1fab9ffbc3ae13f51bd82761690a2cf1eb56b4b31e5cfdee5a042ac55e8b7fc376f01fba18f4c83ac31b5baa5384e5549cd0b33f62199d541acb978b
-
SSDEEP
1536:2N+pfrkqlVZRGWPbrrVqmxPZbrsU0WSGGGGGGGGGGGGGGGGGtECK8TGqVGbunTeK:2N+pT99xRUxFqVSTYkNpD8e8hl
Behavioral task
behavioral1
Sample
0x000600000001ae8f-172.exe
Resource
win7-20230220-en
Malware Config
Extracted
redline
maxud
217.196.96.101:4132
-
auth_value
f1403d964c52b6641ba1ef14803e6e74
Targets
-
-
Target
0x000600000001ae8f-172.dat
-
Size
168KB
-
MD5
2227c129fb171681360f47431a2295ad
-
SHA1
aad96ffce1374e09052cf0603e7369773b78e4e5
-
SHA256
143618563b5ef3c6be00fd620f5b49b4f5a13eaa56b0cd22d59c375f5eba81a1
-
SHA512
f0e33daf1fab9ffbc3ae13f51bd82761690a2cf1eb56b4b31e5cfdee5a042ac55e8b7fc376f01fba18f4c83ac31b5baa5384e5549cd0b33f62199d541acb978b
-
SSDEEP
1536:2N+pfrkqlVZRGWPbrrVqmxPZbrsU0WSGGGGGGGGGGGGGGGGGtECK8TGqVGbunTeK:2N+pT99xRUxFqVSTYkNpD8e8hl
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-