General
-
Target
f8dc56d7c45851399a9a26843decf80bb67790b2f5c8a47d06424336846e56f8
-
Size
489KB
-
Sample
230507-k73m7sfe2y
-
MD5
a46257381e46a504d0b07d133dfaa6a6
-
SHA1
b006a5d920d358dd865c4671f32b59bb3f6ed257
-
SHA256
f8dc56d7c45851399a9a26843decf80bb67790b2f5c8a47d06424336846e56f8
-
SHA512
687e4d3c2f919af10f4e9de7458a216a2b6adff78c6759eb2a284ecf21fc504838f8326b52aedf69b65577115c9458e8eb82e69b761e05e5d13d883415ad62a1
-
SSDEEP
12288:XMr2y90IFoTtQW02H1+biZKvI7Ic+iV6cPzDzsGNycFlvAhS:dylF/86OL+6EeycH4hS
Static task
static1
Behavioral task
behavioral1
Sample
f8dc56d7c45851399a9a26843decf80bb67790b2f5c8a47d06424336846e56f8.exe
Resource
win10-20230220-en
Malware Config
Extracted
redline
lada
217.196.96.101:4132
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Targets
-
-
Target
f8dc56d7c45851399a9a26843decf80bb67790b2f5c8a47d06424336846e56f8
-
Size
489KB
-
MD5
a46257381e46a504d0b07d133dfaa6a6
-
SHA1
b006a5d920d358dd865c4671f32b59bb3f6ed257
-
SHA256
f8dc56d7c45851399a9a26843decf80bb67790b2f5c8a47d06424336846e56f8
-
SHA512
687e4d3c2f919af10f4e9de7458a216a2b6adff78c6759eb2a284ecf21fc504838f8326b52aedf69b65577115c9458e8eb82e69b761e05e5d13d883415ad62a1
-
SSDEEP
12288:XMr2y90IFoTtQW02H1+biZKvI7Ic+iV6cPzDzsGNycFlvAhS:dylF/86OL+6EeycH4hS
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-