General
-
Target
04395199.dat
-
Size
172KB
-
Sample
230609-hza7wabc95
-
MD5
5bda6eb5a444b01dc3f2668e1416b32f
-
SHA1
9f77513a67af867cd70bb1e6a9852dbdfec66ba6
-
SHA256
7e214fffcf367fc5589f85c599bed5c2b6483cb4822a0188e6bfc2154fb7398b
-
SHA512
3b94a0959574f955aa4a3923d4c0985d2f3e3d00424dde8240a86722e20bbff5e131970955ca628fc8aecea59943f0ed1645bf6f1270ad32a18b07d1a99034cd
-
SSDEEP
3072:Ea/jxl3pym/cbcryE2vs0xNQm2f9JiIE/ww8e8h1:EaNcwuqbdniIE/ww
Behavioral task
behavioral1
Sample
04395199.exe
Resource
win7-20230220-en
Malware Config
Extracted
redline
maxi
83.97.73.129:19068
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Targets
-
-
Target
04395199.dat
-
Size
172KB
-
MD5
5bda6eb5a444b01dc3f2668e1416b32f
-
SHA1
9f77513a67af867cd70bb1e6a9852dbdfec66ba6
-
SHA256
7e214fffcf367fc5589f85c599bed5c2b6483cb4822a0188e6bfc2154fb7398b
-
SHA512
3b94a0959574f955aa4a3923d4c0985d2f3e3d00424dde8240a86722e20bbff5e131970955ca628fc8aecea59943f0ed1645bf6f1270ad32a18b07d1a99034cd
-
SSDEEP
3072:Ea/jxl3pym/cbcryE2vs0xNQm2f9JiIE/ww8e8h1:EaNcwuqbdniIE/ww
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-