General
-
Target
525863c539da37c5c0a1800b67ebb2c9209b9d0d7c6c83657d8eaa31fbd9c087
-
Size
799KB
-
Sample
230616-s5kzdafd5s
-
MD5
22190d1ac4b7585564df64e86f0b64c4
-
SHA1
65ad9e9c002d23ad8809d58989279459f2f16451
-
SHA256
525863c539da37c5c0a1800b67ebb2c9209b9d0d7c6c83657d8eaa31fbd9c087
-
SHA512
f13d746a6586191477aa8c6d05b13eb9df3b897c3675dcf9a519e9215c3906be8813905f9170ccf72c724411edde2000153f9c369f051c632c7aad3b64ae7358
-
SSDEEP
24576:wymxKHwgeO533NkttbdErcRXwbzsgWkOJzEv0d:3cKMO533N4dErVzsMOJzEv0
Static task
static1
Malware Config
Extracted
redline
grega
83.97.73.130:19061
-
auth_value
16e2fbc2847b2270b3f0679e2dd76c8d
Extracted
redline
lana
83.97.73.130:19061
-
auth_value
abf586398e9d8028235753690306b7fa
Extracted
amadey
3.81
95.214.27.98/cronus/index.php
Targets
-
-
Target
525863c539da37c5c0a1800b67ebb2c9209b9d0d7c6c83657d8eaa31fbd9c087
-
Size
799KB
-
MD5
22190d1ac4b7585564df64e86f0b64c4
-
SHA1
65ad9e9c002d23ad8809d58989279459f2f16451
-
SHA256
525863c539da37c5c0a1800b67ebb2c9209b9d0d7c6c83657d8eaa31fbd9c087
-
SHA512
f13d746a6586191477aa8c6d05b13eb9df3b897c3675dcf9a519e9215c3906be8813905f9170ccf72c724411edde2000153f9c369f051c632c7aad3b64ae7358
-
SSDEEP
24576:wymxKHwgeO533NkttbdErcRXwbzsgWkOJzEv0d:3cKMO533N4dErVzsMOJzEv0
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-