General
-
Target
09393799.dat
-
Size
172KB
-
Sample
230609-h4fcdscb5v
-
MD5
cbd4e58d92cf27762827471d4242d21d
-
SHA1
77769b34d2eda671a39fddd748b738563b4081bc
-
SHA256
f4b2378ee0046c2b731835a4bb3e55e5a45a7ee2add3e73ff0caf4c293249919
-
SHA512
46894d9d283a6d6683fb1799dfa971a5946bbadbc863d65dd3aa8d7579f2d780a76c5ba13a4c33aee53e3f11ec6f0a124ff771886065a5233bde2f657217163c
-
SSDEEP
3072:QUYvpRfFyNgq8oMGl9ixNcO3qdLbkSh8e8hb:kVoVrLbkSh
Behavioral task
behavioral1
Sample
09393799.exe
Resource
win7-20230220-en
Malware Config
Extracted
redline
duha
83.97.73.129:19068
-
auth_value
aafe99874c3b8854069470882e00246c
Targets
-
-
Target
09393799.dat
-
Size
172KB
-
MD5
cbd4e58d92cf27762827471d4242d21d
-
SHA1
77769b34d2eda671a39fddd748b738563b4081bc
-
SHA256
f4b2378ee0046c2b731835a4bb3e55e5a45a7ee2add3e73ff0caf4c293249919
-
SHA512
46894d9d283a6d6683fb1799dfa971a5946bbadbc863d65dd3aa8d7579f2d780a76c5ba13a4c33aee53e3f11ec6f0a124ff771886065a5233bde2f657217163c
-
SSDEEP
3072:QUYvpRfFyNgq8oMGl9ixNcO3qdLbkSh8e8hb:kVoVrLbkSh
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-