General
-
Target
b4efb79c970f4986050184fdccd0dd06.exe
-
Size
789KB
-
Sample
201101-b8q1dtpbja
-
MD5
b4efb79c970f4986050184fdccd0dd06
-
SHA1
55634b78a92b7949584df0b3ce0e2d01a4a91850
-
SHA256
70af11ae12fdc645f1845b038d01ac9ba1000905c0150553fad12400db54e8dd
-
SHA512
b42dd87439debdfae1bb26479487cab184ecbc10b4b43d7716b291b9b32786d296a74a30b8ce1c9b8e2c8516f42d080e92cf1fd7ae6ef2c12b6955188ae1f880
Malware Config
Targets
-
-
Target
b4efb79c970f4986050184fdccd0dd06.exe
-
Size
789KB
-
MD5
b4efb79c970f4986050184fdccd0dd06
-
SHA1
55634b78a92b7949584df0b3ce0e2d01a4a91850
-
SHA256
70af11ae12fdc645f1845b038d01ac9ba1000905c0150553fad12400db54e8dd
-
SHA512
b42dd87439debdfae1bb26479487cab184ecbc10b4b43d7716b291b9b32786d296a74a30b8ce1c9b8e2c8516f42d080e92cf1fd7ae6ef2c12b6955188ae1f880
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-