General
- Target 2ab4b20da389fd997e1cd746718ed9df.exe
- Size 316KB
- Sample220723-jsn1tsdcdn
- SHA256 33b95b050eeebdf0dbce9a16c8bf7d99a4a6fbe66c17e5c725dbb69d95fcf4c4
- MD5 2ab4b20da389fd997e1cd746718ed9df
- SHA1 c128f75ebf0245bc506b56619d92ed884fc8f8bd
- SHA512 8ded3c18472c9802f9fe3ecb20d779b1dc94edcaa9617f177be9fd4cdd19f10116928fc957711937eb1cec0ab5d71b2b9d4724fb5557e0768040578721f73175
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
2ab4b20da389fd997e1cd746718ed9df.exe
Resource
win7-20220718-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
af
C2
-
trustamsty.com:80
Attributes
-
auth_value
f9fe99fb72fe095ae716b7093f75f872
Targets
-
- Target 2ab4b20da389fd997e1cd746718ed9df.exe
- Size 316KB
- SHA256 33b95b050eeebdf0dbce9a16c8bf7d99a4a6fbe66c17e5c725dbb69d95fcf4c4
- MD5 2ab4b20da389fd997e1cd746718ed9df
- SHA1 c128f75ebf0245bc506b56619d92ed884fc8f8bd
- SHA512 8ded3c18472c9802f9fe3ecb20d779b1dc94edcaa9617f177be9fd4cdd19f10116928fc957711937eb1cec0ab5d71b2b9d4724fb5557e0768040578721f73175
- MD5 SHA1 SHA512
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.