d379063ff5791810690880b0361ffd82e54cc6041100aac7796baa6e5f6ada27

General
Target

d379063ff5791810690880b0361ffd82e54cc6041100aac7796baa6e5f6ada27

Size

249KB

Sample

210926-qzb36sehe6

Score
10 /10
MD5

e6e715287f35a3f71190b0883d3bd8c9

SHA1

4083f0e81a51d8db3b138c621b6c15ff45285180

SHA256

d379063ff5791810690880b0361ffd82e54cc6041100aac7796baa6e5f6ada27

SHA512

08ec274a4f9a8c3ebc02e7184d2d235b00aa541b0028c0a0101ef01afa722474e4bda4123aa5d90e3df01cfedfad0eb7715296fd0d61bacedccfecacfaefa54f

Malware Config

Extracted

Family redline
Botnet PUB
C2

45.9.20.20:13441

Targets
Target

d379063ff5791810690880b0361ffd82e54cc6041100aac7796baa6e5f6ada27

MD5

e6e715287f35a3f71190b0883d3bd8c9

Filesize

249KB

Score
10 /10
SHA1

4083f0e81a51d8db3b138c621b6c15ff45285180

SHA256

d379063ff5791810690880b0361ffd82e54cc6041100aac7796baa6e5f6ada27

SHA512

08ec274a4f9a8c3ebc02e7184d2d235b00aa541b0028c0a0101ef01afa722474e4bda4123aa5d90e3df01cfedfad0eb7715296fd0d61bacedccfecacfaefa54f

Tags

Signatures

  • RedLine

    Description

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    Tags

  • RedLine Payload

  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Accesses cryptocurrency files/wallets, possible credential harvesting

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry

Related Tasks

MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Discovery
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                  Privilege Escalation
                    Tasks