General
-
Target
37bac8328c2d21395abcca4a15321f3e.exe
-
Size
655KB
-
Sample
210212-v83sf72zze
-
MD5
37bac8328c2d21395abcca4a15321f3e
-
SHA1
692945e8ca8a7051c95083d95f53d2e9c0498926
-
SHA256
b3feea58dffddae3a837b055078d8a3ed2db731fd6c7d77aa1164a0185f3b169
-
SHA512
85feed8eae32d63a971bf22863eb5aa5078bb83eedf4794cecd47589fb09a0f2d065c8760298d240923edc1bf446542e1ee6f58b2a3ad6d8d70965ac518b9c44
Malware Config
Targets
-
-
Target
37bac8328c2d21395abcca4a15321f3e.exe
-
Size
655KB
-
MD5
37bac8328c2d21395abcca4a15321f3e
-
SHA1
692945e8ca8a7051c95083d95f53d2e9c0498926
-
SHA256
b3feea58dffddae3a837b055078d8a3ed2db731fd6c7d77aa1164a0185f3b169
-
SHA512
85feed8eae32d63a971bf22863eb5aa5078bb83eedf4794cecd47589fb09a0f2d065c8760298d240923edc1bf446542e1ee6f58b2a3ad6d8d70965ac518b9c44
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-