General
-
Target
4ccf916fe0d3173dc9e6da3de749b437ff651b13bc32bf0538c29fc30c594a8d
-
Size
924KB
-
Sample
201116-amzbtlb2fn
-
MD5
89367213d9c56af06b04275f9322bd82
-
SHA1
126ee4e17ca0df8aae10324242f0ba5d9fb09d5a
-
SHA256
4ccf916fe0d3173dc9e6da3de749b437ff651b13bc32bf0538c29fc30c594a8d
-
SHA512
476b87e0acf64b741f4ec58607abab7f735442e9e87f950956c03e32bd799263482ea0537aa8192065dee5cd0cec1284981c2d6bba852ec722b4cd9e9139927c
Malware Config
Targets
-
-
Target
4ccf916fe0d3173dc9e6da3de749b437ff651b13bc32bf0538c29fc30c594a8d
-
Size
924KB
-
MD5
89367213d9c56af06b04275f9322bd82
-
SHA1
126ee4e17ca0df8aae10324242f0ba5d9fb09d5a
-
SHA256
4ccf916fe0d3173dc9e6da3de749b437ff651b13bc32bf0538c29fc30c594a8d
-
SHA512
476b87e0acf64b741f4ec58607abab7f735442e9e87f950956c03e32bd799263482ea0537aa8192065dee5cd0cec1284981c2d6bba852ec722b4cd9e9139927c
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-