General
- Target 84f1e9613659293dcf2474a0f17e7e5a.exe
- Size 276KB
- Sample220727-mxtcwsgfc4
- SHA256 46ddb248ede5e939b0e25d979ab5f6b74cbe900a57faa167e6ea6ed8bbf01d91
- MD5 84f1e9613659293dcf2474a0f17e7e5a
- SHA1 dfa1f65a895f6843821dc2950ce81f6d4397ba7a
- SHA512 79d889f629d25042800ac826b3ce5a062f4c24d7c850c120f7a555b07466462d7488c69eb4eee0ee026a38ee594aeda585841e6336309ad449123733516c8af5
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
84f1e9613659293dcf2474a0f17e7e5a.exe
Resource
win7-20220718-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
af
C2
-
trustamsty.com:80
Attributes
-
auth_value
f9fe99fb72fe095ae716b7093f75f872
Targets
-
- Target 84f1e9613659293dcf2474a0f17e7e5a.exe
- Size 276KB
- SHA256 46ddb248ede5e939b0e25d979ab5f6b74cbe900a57faa167e6ea6ed8bbf01d91
- MD5 84f1e9613659293dcf2474a0f17e7e5a
- SHA1 dfa1f65a895f6843821dc2950ce81f6d4397ba7a
- SHA512 79d889f629d25042800ac826b3ce5a062f4c24d7c850c120f7a555b07466462d7488c69eb4eee0ee026a38ee594aeda585841e6336309ad449123733516c8af5
- MD5 SHA1 SHA512
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.