General
-
Target
206dd092b5d4a77d2a1da85d5115a5672cd80c2740f59a6dc6bf41d6bfec66f7
-
Size
802KB
-
Sample
230616-my5sbaee82
-
MD5
0f98246033eea85d2bc9c47ca96b98c6
-
SHA1
053ef6bdc25368f8fb028c12fb633964521b87de
-
SHA256
206dd092b5d4a77d2a1da85d5115a5672cd80c2740f59a6dc6bf41d6bfec66f7
-
SHA512
cb32a05752930c6e00212b9536a66957fa2d77f3201a89a9a41beb417ce74a49062c85f948997700147bea90cbbbd2ca5db12292b9bf4688b83ad4aba7bee59e
-
SSDEEP
12288:1MrEy90g7nfbap3V3o12/JwBthqQW7yTmDPce6GNTOHIFmsIeQaLBhDS+OWaNmY+:ByHnfOBJazbW7xDPN+oBI0LBBtOnI4G
Static task
static1
Malware Config
Extracted
redline
joker
83.97.73.130:19061
-
auth_value
a98d303cc28bb3b32a23c59214ae3bc0
Extracted
redline
lana
83.97.73.130:19061
-
auth_value
abf586398e9d8028235753690306b7fa
Extracted
amadey
3.81
95.214.27.98/cronus/index.php
Targets
-
-
Target
206dd092b5d4a77d2a1da85d5115a5672cd80c2740f59a6dc6bf41d6bfec66f7
-
Size
802KB
-
MD5
0f98246033eea85d2bc9c47ca96b98c6
-
SHA1
053ef6bdc25368f8fb028c12fb633964521b87de
-
SHA256
206dd092b5d4a77d2a1da85d5115a5672cd80c2740f59a6dc6bf41d6bfec66f7
-
SHA512
cb32a05752930c6e00212b9536a66957fa2d77f3201a89a9a41beb417ce74a49062c85f948997700147bea90cbbbd2ca5db12292b9bf4688b83ad4aba7bee59e
-
SSDEEP
12288:1MrEy90g7nfbap3V3o12/JwBthqQW7yTmDPce6GNTOHIFmsIeQaLBhDS+OWaNmY+:ByHnfOBJazbW7xDPN+oBI0LBBtOnI4G
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-