General
-
Target
5583131360598e75cbd7a86e1385cdb53ba5ae2b1008ae8ff8357b52f08fce6e
-
Size
352KB
-
Sample
230725-pqstwscd94
-
MD5
e198cd54532a15ebdb46ad9cd335c5b5
-
SHA1
d471ac9a1a82ab4352bc40db6dd3dd60e686818d
-
SHA256
5583131360598e75cbd7a86e1385cdb53ba5ae2b1008ae8ff8357b52f08fce6e
-
SHA512
1647ef7b5950e6cbf95d6760448c6ea6001d4ed285988788f703e955f43eea98c0de36e0c6638c1de49ad3e1e9ce231f1282f4e3dc21d0ce2889cbbf96f0038f
-
SSDEEP
6144:mehDgkiMpmkCDexX4g0FRDELQOQb3evcnng:bhsnMQaxX4g0oLQVRnn
Static task
static1
Malware Config
Extracted
redline
@Germany
194.26.135.162:2920
-
auth_value
9d15d78194367a949e54a07d6ce02c62
Targets
-
-
Target
5583131360598e75cbd7a86e1385cdb53ba5ae2b1008ae8ff8357b52f08fce6e
-
Size
352KB
-
MD5
e198cd54532a15ebdb46ad9cd335c5b5
-
SHA1
d471ac9a1a82ab4352bc40db6dd3dd60e686818d
-
SHA256
5583131360598e75cbd7a86e1385cdb53ba5ae2b1008ae8ff8357b52f08fce6e
-
SHA512
1647ef7b5950e6cbf95d6760448c6ea6001d4ed285988788f703e955f43eea98c0de36e0c6638c1de49ad3e1e9ce231f1282f4e3dc21d0ce2889cbbf96f0038f
-
SSDEEP
6144:mehDgkiMpmkCDexX4g0FRDELQOQb3evcnng:bhsnMQaxX4g0oLQVRnn
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-