General
-
Target
17237DD481939C25479CEB40829B8787.exe
-
Size
95KB
-
Sample
240526-b9t96sbc66
-
MD5
17237dd481939c25479ceb40829b8787
-
SHA1
ea028f7a3d50429f42951d0f50b95e4499ba7b9b
-
SHA256
439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1
-
SHA512
7bdc1d95b5ba9bbac564ef66ab351d9bb51110c3abde8fa7601cb4c9ac3c3eabfccadcbcba8b67b8034a7a41744a15e0ecee498fd0ed1a4cbc3bdf0864a54369
-
SSDEEP
1536:9qs+NqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2QteulgS6pY:rqMOY3+zi0ZbYe1g0ujyzdQY
Behavioral task
behavioral1
Sample
17237DD481939C25479CEB40829B8787.exe
Resource
win7-20240221-en
Malware Config
Extracted
redline
metin2
94.156.8.186:37552
Targets
-
-
Target
17237DD481939C25479CEB40829B8787.exe
-
Size
95KB
-
MD5
17237dd481939c25479ceb40829b8787
-
SHA1
ea028f7a3d50429f42951d0f50b95e4499ba7b9b
-
SHA256
439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1
-
SHA512
7bdc1d95b5ba9bbac564ef66ab351d9bb51110c3abde8fa7601cb4c9ac3c3eabfccadcbcba8b67b8034a7a41744a15e0ecee498fd0ed1a4cbc3bdf0864a54369
-
SSDEEP
1536:9qs+NqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2QteulgS6pY:rqMOY3+zi0ZbYe1g0ujyzdQY
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SectopRAT payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-