General
-
Target
e0b201e817b42e1efcc57aae3a3d4b94.exe
-
Size
654KB
-
Sample
210212-btjabctxva
-
MD5
e0b201e817b42e1efcc57aae3a3d4b94
-
SHA1
49946500104cd9ae82cd2f54563c75d23f6304c5
-
SHA256
6f3f902d2c797c2a9eef8bea492ec2e5c2cccdf3b9e93c7d2d56c4094f02daec
-
SHA512
42666e63468e19842bda39e3f2af0b6b512e272907704f2ee32401a395e78527630089f239343a12fbbb1447583bd4cbbb5cbce7b4b191c479a6aa4d44dbb271
Malware Config
Targets
-
-
Target
e0b201e817b42e1efcc57aae3a3d4b94.exe
-
Size
654KB
-
MD5
e0b201e817b42e1efcc57aae3a3d4b94
-
SHA1
49946500104cd9ae82cd2f54563c75d23f6304c5
-
SHA256
6f3f902d2c797c2a9eef8bea492ec2e5c2cccdf3b9e93c7d2d56c4094f02daec
-
SHA512
42666e63468e19842bda39e3f2af0b6b512e272907704f2ee32401a395e78527630089f239343a12fbbb1447583bd4cbbb5cbce7b4b191c479a6aa4d44dbb271
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-