General
- Target be0fa98d2bec074cc3b5cc7b1e5d4bc6.exe
- Size 403KB
- Sample220726-jcc9dsafg3
- SHA256 601ddb608c894200875c864df531c61ebedbf9351ae21e17bd735dfd4abf4d5b
- MD5 be0fa98d2bec074cc3b5cc7b1e5d4bc6
- SHA1 1904baf289c462d8d361d9b1a4305046c9f6024a
- SHA512 744e701c1d163ce31d1ffbadcb308e2a93e0b06ff222c8d3da62cbc5c0ca48d8e51226001cb3279a15b597711c276c83469584719249cb21c89bd9eecd50f393
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
be0fa98d2bec074cc3b5cc7b1e5d4bc6.exe
Resource
win7-20220715-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
af
C2
-
trustamsty.com:80
Attributes
-
auth_value
f9fe99fb72fe095ae716b7093f75f872
Targets
-
- Target be0fa98d2bec074cc3b5cc7b1e5d4bc6.exe
- Size 403KB
- SHA256 601ddb608c894200875c864df531c61ebedbf9351ae21e17bd735dfd4abf4d5b
- MD5 be0fa98d2bec074cc3b5cc7b1e5d4bc6
- SHA1 1904baf289c462d8d361d9b1a4305046c9f6024a
- SHA512 744e701c1d163ce31d1ffbadcb308e2a93e0b06ff222c8d3da62cbc5c0ca48d8e51226001cb3279a15b597711c276c83469584719249cb21c89bd9eecd50f393
- MD5 SHA1 SHA512
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.