General
- Target file.exe
- Size 386KB
- Sample221026-blm6yseda2
- SHA256 df8cedccee6ab451fe59b40754dd6c4e06a3ba627069d09de0b9455dc1e8ac2a
- MD5 868ba07f3855bfea8fb5c6b3e326b7d2
- SHA1 4fcbb31f20ef5729871284cd5cf3af3083931478
- SHA512 bce897049cf88f0c05ef565993147ad0ac882c5080d40a311dc1e6281756d9cc90a886221714605522747494658ba11f94aea161cc1dde500b9761e1ea4d16ba
- SSDEEP 12288:YL9L0xpded892ssCEkL8Gr71PYGl6WTv:Y8ded8lykwG31UWT
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
dzkey
C2
-
193.106.191.19:47242
Attributes
-
auth_value
52a449fd61ad73c3abc266d47c699ceb
Targets
-
- Target file.exe
- Size 386KB
- SHA256 df8cedccee6ab451fe59b40754dd6c4e06a3ba627069d09de0b9455dc1e8ac2a
- MD5 868ba07f3855bfea8fb5c6b3e326b7d2
- SHA1 4fcbb31f20ef5729871284cd5cf3af3083931478
- SHA512 bce897049cf88f0c05ef565993147ad0ac882c5080d40a311dc1e6281756d9cc90a886221714605522747494658ba11f94aea161cc1dde500b9761e1ea4d16ba
- SSDEEP 12288:YL9L0xpded892ssCEkL8Gr71PYGl6WTv:Y8ded8lykwG31UWT
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.