General
-
Target
550143ccf91c798ea5f5159b479a252910f1cf50f2f83db3d71dbf539ff3ae51
-
Size
489KB
-
Sample
230507-lz98raga9z
-
MD5
d0faf767f1c4a743f6f7c6aeea8c0736
-
SHA1
eb4ad25378f72e533b787010a8db1317029c0b89
-
SHA256
550143ccf91c798ea5f5159b479a252910f1cf50f2f83db3d71dbf539ff3ae51
-
SHA512
1e05e38276750fb87dd014a3bd39e2d423c99f81791a2027c4f64e9593fe3e7d8e57b4f4e2466fbb117c0c2ec86d753f84557da857203b88a99daab9ad4753dd
-
SSDEEP
12288:mMrYy90Oow9bE8ufMNKxQenitodcejKT/j+eD:6yRtxllNKCenwQjKT/j+g
Static task
static1
Behavioral task
behavioral1
Sample
550143ccf91c798ea5f5159b479a252910f1cf50f2f83db3d71dbf539ff3ae51.exe
Resource
win10-20230220-en
Malware Config
Extracted
redline
lada
217.196.96.101:4132
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Targets
-
-
Target
550143ccf91c798ea5f5159b479a252910f1cf50f2f83db3d71dbf539ff3ae51
-
Size
489KB
-
MD5
d0faf767f1c4a743f6f7c6aeea8c0736
-
SHA1
eb4ad25378f72e533b787010a8db1317029c0b89
-
SHA256
550143ccf91c798ea5f5159b479a252910f1cf50f2f83db3d71dbf539ff3ae51
-
SHA512
1e05e38276750fb87dd014a3bd39e2d423c99f81791a2027c4f64e9593fe3e7d8e57b4f4e2466fbb117c0c2ec86d753f84557da857203b88a99daab9ad4753dd
-
SSDEEP
12288:mMrYy90Oow9bE8ufMNKxQenitodcejKT/j+eD:6yRtxllNKCenwQjKT/j+g
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-