General
-
Target
3024-41-0x0000000000DA0000-0x0000000001174000-memory.dmp
-
Size
3.8MB
-
Sample
240424-rtms6abf2z
-
MD5
6b71fdd8f1f9038328a59a3add0d2ef1
-
SHA1
44332545b7142fb020553dc8d6e01d6bdf5be4fc
-
SHA256
3c87b34647d231b32d8857ecf8878b402990014931cc2c44596a1a00793e8662
-
SHA512
6e3478c75a90016985959cdedb76af1618f521c3c52da9b23890fccde65591dfb7880c182f426edc0cb4dc86ae3856d1affa6d4ae7c60381eb284a51442f60cb
-
SSDEEP
98304:a0P6oiUwKDrZIgCyILFGjPtHIaH83kT1:a0lIBtFq1H78E
Behavioral task
behavioral1
Sample
3024-41-0x0000000000DA0000-0x0000000001174000-memory.exe
Resource
win7-20240221-en
Malware Config
Extracted
redline
bild1
193.233.132.169:37732
Targets
-
-
Target
3024-41-0x0000000000DA0000-0x0000000001174000-memory.dmp
-
Size
3.8MB
-
MD5
6b71fdd8f1f9038328a59a3add0d2ef1
-
SHA1
44332545b7142fb020553dc8d6e01d6bdf5be4fc
-
SHA256
3c87b34647d231b32d8857ecf8878b402990014931cc2c44596a1a00793e8662
-
SHA512
6e3478c75a90016985959cdedb76af1618f521c3c52da9b23890fccde65591dfb7880c182f426edc0cb4dc86ae3856d1affa6d4ae7c60381eb284a51442f60cb
-
SSDEEP
98304:a0P6oiUwKDrZIgCyILFGjPtHIaH83kT1:a0lIBtFq1H78E
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-