General
-
Target
d14c5abda3f4a18a156a590b4ea1155e.exe
-
Size
593KB
-
Sample
201227-jnnygg86b2
-
MD5
d14c5abda3f4a18a156a590b4ea1155e
-
SHA1
372372e6c47676aa81e49a69bfe2df2052f43b0c
-
SHA256
a8ae3cb248fb4721b27615276393e430bae895d37794b917f09980bd31c1176c
-
SHA512
0dd28d4f3a9c6c4dcf348c2922c3f635569f0f880825fdc1cb916465e54d9f85af9ad0fd05299ebe0cd142367e09b2ab2020572737c5c9d312c7bebab63f2e1e
Malware Config
Targets
-
-
Target
d14c5abda3f4a18a156a590b4ea1155e.exe
-
Size
593KB
-
MD5
d14c5abda3f4a18a156a590b4ea1155e
-
SHA1
372372e6c47676aa81e49a69bfe2df2052f43b0c
-
SHA256
a8ae3cb248fb4721b27615276393e430bae895d37794b917f09980bd31c1176c
-
SHA512
0dd28d4f3a9c6c4dcf348c2922c3f635569f0f880825fdc1cb916465e54d9f85af9ad0fd05299ebe0cd142367e09b2ab2020572737c5c9d312c7bebab63f2e1e
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Executes dropped EXE
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-