General
-
Target
3327fe395469e10f37ee61d2af1886c29d24fdfa4a26d307fb7fd2a4cfe7ff91
-
Size
306KB
-
Sample
240424-sgathacb3v
-
MD5
e71ac5bd035dc95928f2be552eb35c24
-
SHA1
cb431dfc10497411469248439d9818d247e19f5d
-
SHA256
3327fe395469e10f37ee61d2af1886c29d24fdfa4a26d307fb7fd2a4cfe7ff91
-
SHA512
a50fa624fc4fc55c989e2681613fef193151233353050d78cce7cc52b5052300501273c64a447898c751c6850688751a121d1a35239995c0c6f8f232dcc62a54
-
SSDEEP
6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/
Behavioral task
behavioral1
Sample
3327fe395469e10f37ee61d2af1886c29d24fdfa4a26d307fb7fd2a4cfe7ff91.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
redline
spoo
103.113.70.99:2630
Targets
-
-
Target
3327fe395469e10f37ee61d2af1886c29d24fdfa4a26d307fb7fd2a4cfe7ff91
-
Size
306KB
-
MD5
e71ac5bd035dc95928f2be552eb35c24
-
SHA1
cb431dfc10497411469248439d9818d247e19f5d
-
SHA256
3327fe395469e10f37ee61d2af1886c29d24fdfa4a26d307fb7fd2a4cfe7ff91
-
SHA512
a50fa624fc4fc55c989e2681613fef193151233353050d78cce7cc52b5052300501273c64a447898c751c6850688751a121d1a35239995c0c6f8f232dcc62a54
-
SSDEEP
6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-