General
- Target file.exe
- Size 228KB
- Sample230712-gmffdsda7v
- SHA256 73482d57d8d95b8f24345ab5a962a845f0b05f455ce4037a716df4ae2ff275c0
- MD5 e45634bf0b4ef7b69b4fcad4603cb888
- SHA1 0f917c5045dd233b0acfe314fd697ec06608efcf
- SHA512 c0e57efa847d72c51666c74142a20a69a17e14f4f4d08f3fcb1a8cd666a9e4380cccbfad8df98ef4aa11d9e64b26de9f8f49177c1ca9781784d4e2511674acc1
- SSDEEP 3072:eDUiYyXgMMWmZPrN6VSy6Lc//kmc7r+0N8v+i1SnoImfx:eDV4Vd+SyOcXkmc7Qv+h
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230703-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
lux3
C2
-
176.123.9.142:14845
Attributes
-
auth_value
e94dff9a76da90d6b000642c4a52574b
Targets
-
- Target file.exe
- Size 228KB
- SHA256 73482d57d8d95b8f24345ab5a962a845f0b05f455ce4037a716df4ae2ff275c0
- MD5 e45634bf0b4ef7b69b4fcad4603cb888
- SHA1 0f917c5045dd233b0acfe314fd697ec06608efcf
- SHA512 c0e57efa847d72c51666c74142a20a69a17e14f4f4d08f3fcb1a8cd666a9e4380cccbfad8df98ef4aa11d9e64b26de9f8f49177c1ca9781784d4e2511674acc1
- SSDEEP 3072:eDUiYyXgMMWmZPrN6VSy6Lc//kmc7r+0N8v+i1SnoImfx:eDV4Vd+SyOcXkmc7Qv+h
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.