General
-
Target
29ef19d2703c302f2afd23f0f73d04d2.exe
-
Size
594KB
-
Sample
201229-snl27e6l5a
-
MD5
29ef19d2703c302f2afd23f0f73d04d2
-
SHA1
a453645655b2324e856a488995008d7372937551
-
SHA256
9303fce212e36780ea585709956a75464f3d6eaf2da9211f72ac718dad3e7e80
-
SHA512
123f002c9ee45f5d03845d44ad9d58d1ebb8be3d69c48e16d980816d778fb14453c2cf9e6047460b3b10264b86d849d65ede0f9ef0e410be887f6e432673cfa8
Malware Config
Targets
-
-
Target
29ef19d2703c302f2afd23f0f73d04d2.exe
-
Size
594KB
-
MD5
29ef19d2703c302f2afd23f0f73d04d2
-
SHA1
a453645655b2324e856a488995008d7372937551
-
SHA256
9303fce212e36780ea585709956a75464f3d6eaf2da9211f72ac718dad3e7e80
-
SHA512
123f002c9ee45f5d03845d44ad9d58d1ebb8be3d69c48e16d980816d778fb14453c2cf9e6047460b3b10264b86d849d65ede0f9ef0e410be887f6e432673cfa8
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Executes dropped EXE
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-