General
-
Target
bb74d8ec233dd105f813b778f437eeb3.bin
-
Size
241KB
-
Sample
230729-b843zsae55
-
MD5
6182484365539cfa34be288c0dcf1151
-
SHA1
afdbd30b923ce538c4205292bc377008fdc9a392
-
SHA256
bce7b1a291db1e54fa4b5d2816b5976754267b2e52b101ba848b9b35cb7f1bbf
-
SHA512
a6421760e3f8c9caa6845d2dc382519d7cbf54d856639a48e46e9144366962ba26d7d974d63034dc43f81834965841a28d600e1392503ee8a5c79a6532f91455
-
SSDEEP
6144:o4wtiGqBK9Zd0WvxfdVSGMey+9SFWZzR5YbIu:oDoWZDvx1M2Ss3pu
Static task
static1
Behavioral task
behavioral1
Sample
edb1307f1fd091e464831bfc974dc7c4db9586095f3112a3bed99f5601213eb8.exe
Resource
win7-20230712-en
Malware Config
Extracted
redline
@Germany
194.26.135.162:2920
-
auth_value
9d15d78194367a949e54a07d6ce02c62
Targets
-
-
Target
edb1307f1fd091e464831bfc974dc7c4db9586095f3112a3bed99f5601213eb8.exe
-
Size
411KB
-
MD5
bb74d8ec233dd105f813b778f437eeb3
-
SHA1
9c57c2d705665ca9226fa6ef1c72fab760cd3595
-
SHA256
edb1307f1fd091e464831bfc974dc7c4db9586095f3112a3bed99f5601213eb8
-
SHA512
374ec56617cb5fe1dc4a1572b27d49c481bd46d1ba4d1f87b1af533437997c916d75a888c5cacc146a8b61d3e672b27c6c6415cc9ce8426c1032040e76ce451f
-
SSDEEP
6144:eF/e4oeaMMJ2+3qZK6jaP6aAltjTgXrtC08PJOYXEGo:ezohMMfataqjKw
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-