General
-
Target
b30ffcfb5f88625e8b529f45969d7b1e.exe
-
Size
1.1MB
-
Sample
240229-h7qbrsac63
-
MD5
b30ffcfb5f88625e8b529f45969d7b1e
-
SHA1
b0fb64640b13d07e1679024bf1df0a492323d4ae
-
SHA256
68ce0b654df185f888ce7bc64305873778b4090e38abe5b933ff6cc864194753
-
SHA512
502d57a1862333c0b56094695c152dbc1759e279771af2905e3f32838d36394807dc759c058a3804339d0e7931cbdb939c9632bfd34274de40d391b8c587f1c9
-
SSDEEP
24576:yT3cqYbqD+MFJ7bkbgKqLpUKdA00NsnvbBVAgGA+:yDY+CKbkbgKGz0NsnvbLq
Malware Config
Extracted
redline
TEST
185.172.129.234:34244
Targets
-
-
Target
b30ffcfb5f88625e8b529f45969d7b1e.exe
-
Size
1.1MB
-
MD5
b30ffcfb5f88625e8b529f45969d7b1e
-
SHA1
b0fb64640b13d07e1679024bf1df0a492323d4ae
-
SHA256
68ce0b654df185f888ce7bc64305873778b4090e38abe5b933ff6cc864194753
-
SHA512
502d57a1862333c0b56094695c152dbc1759e279771af2905e3f32838d36394807dc759c058a3804339d0e7931cbdb939c9632bfd34274de40d391b8c587f1c9
-
SSDEEP
24576:yT3cqYbqD+MFJ7bkbgKqLpUKdA00NsnvbBVAgGA+:yDY+CKbkbgKGz0NsnvbLq
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-