General
- Target 68182a22d93060350637cec6b0d2bcdb.exe
- Size 391KB
- Sample220903-skk4msggek
- SHA256 d54ea4b1eb7deebeeba9c49fbc8d89ba4fd1dab364e763df267c5816eb360001
- MD5 68182a22d93060350637cec6b0d2bcdb
- SHA1 118f87140eb1a913aea523abbc04301ce2be27d4
- SHA512 42e3224a8baf61b7dda564dcacdaecb978daa4532bbc5c8e0707aa50948ebe7e7874306fc54cad8301d3f9f6bc1fd7542ac5fea26a382d5a6ae9e37865c056e4
- SSDEEP 6144:veXaLRMq/G/0r9n9d2zA0fP+0uaBFFWWXt7:vCZqfZ9d2z3fP+Y7Fr7
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
68182a22d93060350637cec6b0d2bcdb.exe
Resource
win7-20220901-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
twick
C2
-
trustedwicky.com:80
Attributes
-
auth_value
2284521981f16053dae08194ef371cb3
Targets
-
- Target 68182a22d93060350637cec6b0d2bcdb.exe
- Size 391KB
- SHA256 d54ea4b1eb7deebeeba9c49fbc8d89ba4fd1dab364e763df267c5816eb360001
- MD5 68182a22d93060350637cec6b0d2bcdb
- SHA1 118f87140eb1a913aea523abbc04301ce2be27d4
- SHA512 42e3224a8baf61b7dda564dcacdaecb978daa4532bbc5c8e0707aa50948ebe7e7874306fc54cad8301d3f9f6bc1fd7542ac5fea26a382d5a6ae9e37865c056e4
- SSDEEP 6144:veXaLRMq/G/0r9n9d2zA0fP+0uaBFFWWXt7:vCZqfZ9d2z3fP+Y7Fr7
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.