General
-
Target
48a7b45d8b21337b1c63394fa34b2dfa.exe
-
Size
667KB
-
Sample
201102-ptpzfmb8na
-
MD5
48a7b45d8b21337b1c63394fa34b2dfa
-
SHA1
815c1c6e843a1c8b9ead4e78038792e731b0cedf
-
SHA256
2224e77a950a10ddf527d06e3083641ef929afcf2eb7d195f749f404a511f4c2
-
SHA512
280436837a57cb92b1f10b929828e94064f1df816cf6b9ffe77e8274f96a05e4d56d8ef1f7b56c0d84e0b1e2e603955adb55afa7257a6ab295d427eb2571eb7f
Malware Config
Targets
-
-
Target
48a7b45d8b21337b1c63394fa34b2dfa.exe
-
Size
667KB
-
MD5
48a7b45d8b21337b1c63394fa34b2dfa
-
SHA1
815c1c6e843a1c8b9ead4e78038792e731b0cedf
-
SHA256
2224e77a950a10ddf527d06e3083641ef929afcf2eb7d195f749f404a511f4c2
-
SHA512
280436837a57cb92b1f10b929828e94064f1df816cf6b9ffe77e8274f96a05e4d56d8ef1f7b56c0d84e0b1e2e603955adb55afa7257a6ab295d427eb2571eb7f
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-