General
- Target c02bc1b7a68186cc11d639850ab574e3.exe
- Size 409KB
- Sample220119-kfc88sgcd7
- SHA256 5bfc69a27e6c79007f6eeb1aec4c5b97c84f39082edd719e1af821e1ab6fe9f0
- MD5 c02bc1b7a68186cc11d639850ab574e3
- SHA1 4df3b077a230ab1cb477af3ed6e76d9de0e11f4d
- SHA512 31f3e434095a35646621eae777af66f6f9e1ab02796dbc82e9debb7e7da99e12dda7b84b7246b1183fac26f3b4be2feed14031ffc9ccce598b4528b58c40fcbb
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
c02bc1b7a68186cc11d639850ab574e3.exe
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c02bc1b7a68186cc11d639850ab574e3.exe
Resource
win10v2004-en-20220113
0 signatures
0 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
Pablicher
C2
-
185.215.113.10:39759
Targets
-
- Target c02bc1b7a68186cc11d639850ab574e3.exe
- Size 409KB
- SHA256 5bfc69a27e6c79007f6eeb1aec4c5b97c84f39082edd719e1af821e1ab6fe9f0
- MD5 c02bc1b7a68186cc11d639850ab574e3
- SHA1 4df3b077a230ab1cb477af3ed6e76d9de0e11f4d
- SHA512 31f3e434095a35646621eae777af66f6f9e1ab02796dbc82e9debb7e7da99e12dda7b84b7246b1183fac26f3b4be2feed14031ffc9ccce598b4528b58c40fcbb
- MD5 SHA1 SHA512
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.