General
-
Target
5f8b9c2b8a105b3b193216b0bae6b9f3d8dafe7090c63f8a1b2a896d691b81be
-
Size
735KB
-
Sample
230616-m9ckxaef57
-
MD5
323f089decd85fc1b9825509db99eadc
-
SHA1
bfdba0f0207d80b7128e801961bbf0b15242f693
-
SHA256
5f8b9c2b8a105b3b193216b0bae6b9f3d8dafe7090c63f8a1b2a896d691b81be
-
SHA512
75e2146ad28845be6957a6ce42a8b71d5bdf411d389b98f8d07a071fe8748d1943524507eccbc81dcc5007632cacd0aec2acf8931934f5b6e66e21bfeec01fb0
-
SSDEEP
12288:VMr1y90y9Vm3mrQz29v5SNdDcKV5HcQ0u/yB7y33t4c6pWGZSkF+:IyrVQmrOWAD/UQR/54xpWySkF+
Static task
static1
Malware Config
Extracted
redline
dana
83.97.73.130:19061
-
auth_value
da2d1691db653e49676d799e1eae2673
Extracted
amadey
3.84
77.91.68.63/doma/net/index.php
Extracted
redline
joker
83.97.73.130:19061
-
auth_value
a98d303cc28bb3b32a23c59214ae3bc0
Targets
-
-
Target
5f8b9c2b8a105b3b193216b0bae6b9f3d8dafe7090c63f8a1b2a896d691b81be
-
Size
735KB
-
MD5
323f089decd85fc1b9825509db99eadc
-
SHA1
bfdba0f0207d80b7128e801961bbf0b15242f693
-
SHA256
5f8b9c2b8a105b3b193216b0bae6b9f3d8dafe7090c63f8a1b2a896d691b81be
-
SHA512
75e2146ad28845be6957a6ce42a8b71d5bdf411d389b98f8d07a071fe8748d1943524507eccbc81dcc5007632cacd0aec2acf8931934f5b6e66e21bfeec01fb0
-
SSDEEP
12288:VMr1y90y9Vm3mrQz29v5SNdDcKV5HcQ0u/yB7y33t4c6pWGZSkF+:IyrVQmrOWAD/UQR/54xpWySkF+
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-