General
-
Target
6cc2df98560b918f5eb6260d044856a9e917f24d4103229be6b7f566a1a91f8f
-
Size
305KB
-
Sample
240424-ntb5wahd2z
-
MD5
b06afde2d2ecfd404d424108a5d8dfc3
-
SHA1
ef6e54b465a8dfa8f4fa79c2a30ead1d694d6ae3
-
SHA256
6cc2df98560b918f5eb6260d044856a9e917f24d4103229be6b7f566a1a91f8f
-
SHA512
d29156827d13b65541e548d8d15975d8667ed484d13d5515a399641a85fb6e8b033d3df63e14e9a6ccd93545bc9955b33cccf34eeda500fc32d51ee8e3ce9c49
-
SSDEEP
6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/
Behavioral task
behavioral1
Sample
6cc2df98560b918f5eb6260d044856a9e917f24d4103229be6b7f566a1a91f8f.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
redline
spoo
103.113.70.99:2630
Targets
-
-
Target
6cc2df98560b918f5eb6260d044856a9e917f24d4103229be6b7f566a1a91f8f
-
Size
305KB
-
MD5
b06afde2d2ecfd404d424108a5d8dfc3
-
SHA1
ef6e54b465a8dfa8f4fa79c2a30ead1d694d6ae3
-
SHA256
6cc2df98560b918f5eb6260d044856a9e917f24d4103229be6b7f566a1a91f8f
-
SHA512
d29156827d13b65541e548d8d15975d8667ed484d13d5515a399641a85fb6e8b033d3df63e14e9a6ccd93545bc9955b33cccf34eeda500fc32d51ee8e3ce9c49
-
SSDEEP
6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-