General
-
Target
96e08e4b74bcb62e115e7c38d87f2013.exe
-
Size
690KB
-
Sample
210222-wf8lmye4bn
-
MD5
96e08e4b74bcb62e115e7c38d87f2013
-
SHA1
13f8bbd6ad0eec4340819da4b71a2b7c2ed00fb6
-
SHA256
96802cd1e7ee797e260cf5379cdd8526379b6ab1c396c21f1db1dae4ca111e93
-
SHA512
77e8c7d6c7ceadb01e8f8105e0fc071a305a946ef9bd4a8512437cbb387cf32dd571debd7fe371a1eec731755461b64830883a3e977634077fa4e5c80a89fe0d
Malware Config
Targets
-
-
Target
96e08e4b74bcb62e115e7c38d87f2013.exe
-
Size
690KB
-
MD5
96e08e4b74bcb62e115e7c38d87f2013
-
SHA1
13f8bbd6ad0eec4340819da4b71a2b7c2ed00fb6
-
SHA256
96802cd1e7ee797e260cf5379cdd8526379b6ab1c396c21f1db1dae4ca111e93
-
SHA512
77e8c7d6c7ceadb01e8f8105e0fc071a305a946ef9bd4a8512437cbb387cf32dd571debd7fe371a1eec731755461b64830883a3e977634077fa4e5c80a89fe0d
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-