General
-
Target
687d0b0186e4533c96949185042937a69acafb01720207a61a402b045d29a38a.exe
-
Size
775KB
-
Sample
230612-qbtnbacc82
-
MD5
7a6cd742e076a9e208f3e97f96e59692
-
SHA1
249625563a389cc1a770026383e0ee4243006ea2
-
SHA256
687d0b0186e4533c96949185042937a69acafb01720207a61a402b045d29a38a
-
SHA512
41beca7cbdacf1b62e38aff0097bb2b2ba8e9854cd60389b8ea5a5b25343c3c3ef22d541237114361ac28568fff65d50008c78566466f5c408d7fd0b1c555af8
-
SSDEEP
24576:wydfXKWY7O2r+HTRde/UC7/qH6bm4pfN3:3hXY7OdeMCjqH6bm4N
Static task
static1
Malware Config
Extracted
redline
boris
83.97.73.129:19068
-
auth_value
205e4fccc0f8c7da1d56fb1da4ac5e6a
Extracted
redline
moro
83.97.73.129:19068
-
auth_value
24d4f20def584fcfb9067c13ead26e63
Extracted
amadey
3.83
77.91.68.30/music/rock/index.php
Extracted
redline
doro
83.97.73.129:19068
-
auth_value
03f411441fb3fa233179c2cc8ffbce27
Targets
-
-
Target
687d0b0186e4533c96949185042937a69acafb01720207a61a402b045d29a38a.exe
-
Size
775KB
-
MD5
7a6cd742e076a9e208f3e97f96e59692
-
SHA1
249625563a389cc1a770026383e0ee4243006ea2
-
SHA256
687d0b0186e4533c96949185042937a69acafb01720207a61a402b045d29a38a
-
SHA512
41beca7cbdacf1b62e38aff0097bb2b2ba8e9854cd60389b8ea5a5b25343c3c3ef22d541237114361ac28568fff65d50008c78566466f5c408d7fd0b1c555af8
-
SSDEEP
24576:wydfXKWY7O2r+HTRde/UC7/qH6bm4pfN3:3hXY7OdeMCjqH6bm4N
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-