General
- Target file.exe
- Size 379KB
- Sample221024-e6hzhsedf2
- SHA256 991c8dfbe0a289193571e5a0c7accc97d78854fdf99b81fa54621cbf9cb19ceb
- MD5 d96cb7305b09d75aa68d0846124b0a97
- SHA1 47b82296467aa3ee8d6263a8a9dcede99e8e8d58
- SHA512 fc0ae4719637a5d3fef2b286f7d4382973e2140e1fe871db245afbb97aa48e7c6fe4d419d3a8d89816eb724932fd02bdaca14c4b62dbc1558ae93df3cdf9355e
- SSDEEP 6144:GWIh9LTZ72xhMdohgdd1HOFgxSVkpBY4Y1JpFxRVP6sPLq5aS5XiPD:GWIjpCxhMSUddTxAkpy4CJpFVv2LSb
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
Dozkey
C2
-
91.212.166.17:47242
Attributes
-
auth_value
c06f8f31502cdaf6d673db7589189fd5
Targets
-
- Target file.exe
- Size 379KB
- SHA256 991c8dfbe0a289193571e5a0c7accc97d78854fdf99b81fa54621cbf9cb19ceb
- MD5 d96cb7305b09d75aa68d0846124b0a97
- SHA1 47b82296467aa3ee8d6263a8a9dcede99e8e8d58
- SHA512 fc0ae4719637a5d3fef2b286f7d4382973e2140e1fe871db245afbb97aa48e7c6fe4d419d3a8d89816eb724932fd02bdaca14c4b62dbc1558ae93df3cdf9355e
- SSDEEP 6144:GWIh9LTZ72xhMdohgdd1HOFgxSVkpBY4Y1JpFxRVP6sPLq5aS5XiPD:GWIjpCxhMSUddTxAkpy4CJpFVv2LSb
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.