2471c8a95b36fbc881437b51377ebd97cb8d2352f1a4caa63759068dea2cfbfd

General
Target

2471c8a95b36fbc881437b51377ebd97cb8d2352f1a4caa63759068dea2cfbfd

Size

250KB

Sample

210926-qltfaseggn

Score
10 /10
MD5

a5ab256c4f1675dc76ffa136c0ca3549

SHA1

c84b22070fd0b14b5e932ac41e9be1c84496cea5

SHA256

2471c8a95b36fbc881437b51377ebd97cb8d2352f1a4caa63759068dea2cfbfd

SHA512

7c21963b0280f656c6c6f926b32b0d85c99042468f5a033ea2174e5d638249041e0ea795eecf6c8b17438d78011249a8c5ccb5f7041dcccfeede1c676a58e828

Malware Config

Extracted

Family redline
Botnet UDP
C2

45.9.20.20:13441

Targets
Target

2471c8a95b36fbc881437b51377ebd97cb8d2352f1a4caa63759068dea2cfbfd

MD5

a5ab256c4f1675dc76ffa136c0ca3549

Filesize

250KB

Score
10 /10
SHA1

c84b22070fd0b14b5e932ac41e9be1c84496cea5

SHA256

2471c8a95b36fbc881437b51377ebd97cb8d2352f1a4caa63759068dea2cfbfd

SHA512

7c21963b0280f656c6c6f926b32b0d85c99042468f5a033ea2174e5d638249041e0ea795eecf6c8b17438d78011249a8c5ccb5f7041dcccfeede1c676a58e828

Tags

Signatures

  • RedLine

    Description

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    Tags

  • RedLine Payload

  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Accesses cryptocurrency files/wallets, possible credential harvesting

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry

Related Tasks

MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Discovery
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                  Privilege Escalation
                    Tasks