General
- Target b2e4f6a1d325230f2df48c386cf7b09d
- Size 319KB
- Sample220714-esh3cschdl
- SHA256 10bd97d9f4a37b1378c69052cf2afd0af1161333c8b4364dbff1f81e9765ce7b
- MD5 b2e4f6a1d325230f2df48c386cf7b09d
- SHA1 15ceac45838fe03eaaca9a72e78a33e59b0d6065
- SHA512 e8601508574dae5cb1e741bdfa073f6d7ae9c0d23a29ee3a96a491c821a39a6ccc175737ebda02d0873e6fb2fa06de856433539547484fba3f8c7fdadcc177ba
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
b2e4f6a1d325230f2df48c386cf7b09d.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
RZ
C2
-
193.106.191.81:23196
Attributes
-
auth_value
4f816b599d2b63fb976620fbf8dcfd11
Targets
-
- Target b2e4f6a1d325230f2df48c386cf7b09d
- Size 319KB
- SHA256 10bd97d9f4a37b1378c69052cf2afd0af1161333c8b4364dbff1f81e9765ce7b
- MD5 b2e4f6a1d325230f2df48c386cf7b09d
- SHA1 15ceac45838fe03eaaca9a72e78a33e59b0d6065
- SHA512 e8601508574dae5cb1e741bdfa073f6d7ae9c0d23a29ee3a96a491c821a39a6ccc175737ebda02d0873e6fb2fa06de856433539547484fba3f8c7fdadcc177ba
- MD5 SHA1 SHA512
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.