General
-
Target
Wallet.exe
-
Size
460KB
-
Sample
240122-2xt2raeeb2
-
MD5
33e20d17d1ac19b0491fa9d71fb30296
-
SHA1
41b4631a0d5a33598f4ae3c9726709d658116570
-
SHA256
4029b7967eac8e5c7e441915fbe24552b56bb52b044ccd447a1ade6db574d7c2
-
SHA512
f19146181a2c59c2204f9931a3c979827ccdd3a4ba59880cbde4e5206311c63a9af681931c0039c3216d2398e1591d94803e538f784e0f9910cc589437800603
-
SSDEEP
6144:KETbLiOeeI26BKN/jXY2SwAyvNv8b/HV/AtbwGqwFp5JJDz87KVXTnyJYNDKT:ZHGtEaKNLZurV0bwGqwTGKVGCNG
Malware Config
Targets
-
-
Target
Wallet.exe
-
Size
460KB
-
MD5
33e20d17d1ac19b0491fa9d71fb30296
-
SHA1
41b4631a0d5a33598f4ae3c9726709d658116570
-
SHA256
4029b7967eac8e5c7e441915fbe24552b56bb52b044ccd447a1ade6db574d7c2
-
SHA512
f19146181a2c59c2204f9931a3c979827ccdd3a4ba59880cbde4e5206311c63a9af681931c0039c3216d2398e1591d94803e538f784e0f9910cc589437800603
-
SSDEEP
6144:KETbLiOeeI26BKN/jXY2SwAyvNv8b/HV/AtbwGqwFp5JJDz87KVXTnyJYNDKT:ZHGtEaKNLZurV0bwGqwTGKVGCNG
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-