General
-
Target
file.exe
-
Size
411KB
-
Sample
230727-w4babshf4v
-
MD5
bb74d8ec233dd105f813b778f437eeb3
-
SHA1
9c57c2d705665ca9226fa6ef1c72fab760cd3595
-
SHA256
edb1307f1fd091e464831bfc974dc7c4db9586095f3112a3bed99f5601213eb8
-
SHA512
374ec56617cb5fe1dc4a1572b27d49c481bd46d1ba4d1f87b1af533437997c916d75a888c5cacc146a8b61d3e672b27c6c6415cc9ce8426c1032040e76ce451f
-
SSDEEP
6144:eF/e4oeaMMJ2+3qZK6jaP6aAltjTgXrtC08PJOYXEGo:ezohMMfataqjKw
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230712-en
Malware Config
Extracted
redline
@Germany
194.26.135.162:2920
-
auth_value
9d15d78194367a949e54a07d6ce02c62
Targets
-
-
Target
file.exe
-
Size
411KB
-
MD5
bb74d8ec233dd105f813b778f437eeb3
-
SHA1
9c57c2d705665ca9226fa6ef1c72fab760cd3595
-
SHA256
edb1307f1fd091e464831bfc974dc7c4db9586095f3112a3bed99f5601213eb8
-
SHA512
374ec56617cb5fe1dc4a1572b27d49c481bd46d1ba4d1f87b1af533437997c916d75a888c5cacc146a8b61d3e672b27c6c6415cc9ce8426c1032040e76ce451f
-
SSDEEP
6144:eF/e4oeaMMJ2+3qZK6jaP6aAltjTgXrtC08PJOYXEGo:ezohMMfataqjKw
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-