General
-
Target
5db5a16993b705815172eae6473b3708.exe
-
Size
530KB
-
Sample
210219-m83kcdrzss
-
MD5
5db5a16993b705815172eae6473b3708
-
SHA1
162a85d7d1491547e3455ab742e994c77e74f1c7
-
SHA256
0c0f298ef912b9bcd172a997fd89829b4917e91e92dfbda6135b16a0464229e6
-
SHA512
b0f185174103607ff3d253fc7ffa22250248d9096613d56f9a6317cb317023aacfa6fa0abd474ef9956cc2fbe47252873b40f87d421a4190fe1b3795bc181bf8
Malware Config
Targets
-
-
Target
5db5a16993b705815172eae6473b3708.exe
-
Size
530KB
-
MD5
5db5a16993b705815172eae6473b3708
-
SHA1
162a85d7d1491547e3455ab742e994c77e74f1c7
-
SHA256
0c0f298ef912b9bcd172a997fd89829b4917e91e92dfbda6135b16a0464229e6
-
SHA512
b0f185174103607ff3d253fc7ffa22250248d9096613d56f9a6317cb317023aacfa6fa0abd474ef9956cc2fbe47252873b40f87d421a4190fe1b3795bc181bf8
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-