General
- Target file.exe
- Size 441KB
- Sample221102-prrm8abgh7
- SHA256 087bc7fabc185aeecb627082cce57966d073d91de197e7766946c942bed778a5
- MD5 ff775eeb63c953b0d26d73387a608458
- SHA1 b5a4be5b36344e38b5e01c688a330a2d985a6422
- SHA512 6c21fb63a624e7b4c07626f8697320a261a2739cb6f40cc0ef2b3fae652baa07bd21fe5d3a9af5c4567bdede4dc07056408bb2df24a6943bb439988fc4145f9c
- SSDEEP 6144:V8rGFUntuffPm0OZtrb7Xjzeo9f7BjbY7ITsq:V8KUntu3PjO/7Tzea75bY7
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
mix
C2
-
193.106.191.25:47242
Attributes
-
auth_value
5469d87831a100553f2f10d3aadec8bb
Targets
-
- Target file.exe
- Size 441KB
- SHA256 087bc7fabc185aeecb627082cce57966d073d91de197e7766946c942bed778a5
- MD5 ff775eeb63c953b0d26d73387a608458
- SHA1 b5a4be5b36344e38b5e01c688a330a2d985a6422
- SHA512 6c21fb63a624e7b4c07626f8697320a261a2739cb6f40cc0ef2b3fae652baa07bd21fe5d3a9af5c4567bdede4dc07056408bb2df24a6943bb439988fc4145f9c
- SSDEEP 6144:V8rGFUntuffPm0OZtrb7Xjzeo9f7BjbY7ITsq:V8KUntu3PjO/7Tzea75bY7
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.