General
-
Target
SecuriteInfo.com.BehavesLike.Win32.PWSBanker.jc.9201
-
Size
689KB
-
Sample
201224-bvaxvby93x
-
MD5
51288b568d0de420bd5437b159fb6cf6
-
SHA1
b235cc619a5630563350a294d1bf458b4c13d51c
-
SHA256
02bbf035118763cfa7297a8b81bc54eb288cc578f5c71d055795b15885bb1e07
-
SHA512
8d21bfbcafb9372725eb279b3422178e0f5b57124f9425a1638fb2a52fdfb83daf5647cf21b7adfafc71f106e9978aa2b8cb861fec7196b2758a5cc94653a112
Malware Config
Targets
-
-
Target
SecuriteInfo.com.BehavesLike.Win32.PWSBanker.jc.9201
-
Size
689KB
-
MD5
51288b568d0de420bd5437b159fb6cf6
-
SHA1
b235cc619a5630563350a294d1bf458b4c13d51c
-
SHA256
02bbf035118763cfa7297a8b81bc54eb288cc578f5c71d055795b15885bb1e07
-
SHA512
8d21bfbcafb9372725eb279b3422178e0f5b57124f9425a1638fb2a52fdfb83daf5647cf21b7adfafc71f106e9978aa2b8cb861fec7196b2758a5cc94653a112
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Executes dropped EXE
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-