General
- Target 5dacbb9b99f1c0d67cb623338885c166.exe
- Size 332KB
- Sample220628-rhtsbshhdn
- SHA256 d0935b33a6b2b816ff1183e6d20f5c56228e39adfd0c8504bc7d0e8c67294dee
- MD5 5dacbb9b99f1c0d67cb623338885c166
- SHA1 5c5461348f0beb391f5a302c8b46a9757a586352
- SHA512 f21d19b572312c2f4e10589c4b2b1e62f23a6f595c3bbfe3c3a73b1c9a7bd099e2b62434d5fd2c781b32476dfed2ff6830f570cb446baefb5b35ade4935f6725
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
5dacbb9b99f1c0d67cb623338885c166.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
ruzkii
C2
-
193.106.191.81:23196
Attributes
-
auth_value
a2e61f725b549c0f63f5055c64a5b701
Targets
-
- Target 5dacbb9b99f1c0d67cb623338885c166.exe
- Size 332KB
- SHA256 d0935b33a6b2b816ff1183e6d20f5c56228e39adfd0c8504bc7d0e8c67294dee
- MD5 5dacbb9b99f1c0d67cb623338885c166
- SHA1 5c5461348f0beb391f5a302c8b46a9757a586352
- SHA512 f21d19b572312c2f4e10589c4b2b1e62f23a6f595c3bbfe3c3a73b1c9a7bd099e2b62434d5fd2c781b32476dfed2ff6830f570cb446baefb5b35ade4935f6725
- MD5 SHA1 SHA512
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.