General
-
Target
NA_4eae100521922e9249c423378_JC.exe
-
Size
405KB
-
Sample
230728-tdbgaseg2z
-
MD5
af5280ef73f52091f8112d89515a4180
-
SHA1
6ad079df834a88695cd4310527831ba557d83db9
-
SHA256
4eae100521922e9249c423378708ecc0d393502c68bfc3216dbf75ca0faef949
-
SHA512
5680a30b22613dfb1046e0a0f50c27beade09cbc8341fd9e46502af2b4756d18e3ade4abf61318dad0d5e2016fff7b8d8c360a41ed0d382a269eff6c13e24fa8
-
SSDEEP
6144:Vq92ReGXMH3KEpkEuku6mRJZ45yPs2NHBaqCpe0R5H6gFt:NYGXMXKEZutJqisW+/5zF
Static task
static1
Behavioral task
behavioral1
Sample
NA_4eae100521922e9249c423378_JC.exe
Resource
win7-20230712-en
Malware Config
Extracted
redline
@Germany
194.26.135.162:2920
-
auth_value
9d15d78194367a949e54a07d6ce02c62
Targets
-
-
Target
NA_4eae100521922e9249c423378_JC.exe
-
Size
405KB
-
MD5
af5280ef73f52091f8112d89515a4180
-
SHA1
6ad079df834a88695cd4310527831ba557d83db9
-
SHA256
4eae100521922e9249c423378708ecc0d393502c68bfc3216dbf75ca0faef949
-
SHA512
5680a30b22613dfb1046e0a0f50c27beade09cbc8341fd9e46502af2b4756d18e3ade4abf61318dad0d5e2016fff7b8d8c360a41ed0d382a269eff6c13e24fa8
-
SSDEEP
6144:Vq92ReGXMH3KEpkEuku6mRJZ45yPs2NHBaqCpe0R5H6gFt:NYGXMXKEZutJqisW+/5zF
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-