General
-
Target
e1dbb4d7308b83fa578a49acb3f8d23b643824ba5626ee3c4b7abd7b6c4f7ac5.exe
-
Size
3.4MB
-
Sample
240515-cecbjsbg4y
-
MD5
db427cc5464c265577871c31bc1065d0
-
SHA1
796cf29ee18ef8997b901295326f18dbe0d0a7dd
-
SHA256
e1dbb4d7308b83fa578a49acb3f8d23b643824ba5626ee3c4b7abd7b6c4f7ac5
-
SHA512
5002167b41cd4460417d72a283aded7d0c7c9fc171cc6996abd5fbcd02f0fbb217164e189a042631d4abf5f76d84b7b24b94008d8027b5a86b2f19523c1bc993
-
SSDEEP
24576:TVsQ6BKfC+CWDU2fy6Uuri8MmOmbCYUz7PH8Zeaj0HM3ow5XtyB:TVeBB2kMOnYUvPb
Malware Config
Extracted
redline
cheat
91.92.249.99:13359
Targets
-
-
Target
e1dbb4d7308b83fa578a49acb3f8d23b643824ba5626ee3c4b7abd7b6c4f7ac5.exe
-
Size
3.4MB
-
MD5
db427cc5464c265577871c31bc1065d0
-
SHA1
796cf29ee18ef8997b901295326f18dbe0d0a7dd
-
SHA256
e1dbb4d7308b83fa578a49acb3f8d23b643824ba5626ee3c4b7abd7b6c4f7ac5
-
SHA512
5002167b41cd4460417d72a283aded7d0c7c9fc171cc6996abd5fbcd02f0fbb217164e189a042631d4abf5f76d84b7b24b94008d8027b5a86b2f19523c1bc993
-
SSDEEP
24576:TVsQ6BKfC+CWDU2fy6Uuri8MmOmbCYUz7PH8Zeaj0HM3ow5XtyB:TVeBB2kMOnYUvPb
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects executables packed with ConfuserEx Mod
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-