General

  • Target

    3a29db8c7caf9d999a35298da6afcdca99c1b64d6195abecd21962fd15dc4416

  • Size

    284KB

  • Sample

    211124-y1n35adehn

  • MD5

    257225c69bce80a10227a6d158217989

  • SHA1

    eef104788d8ec248357868a1a8005308a900a87c

  • SHA256

    3a29db8c7caf9d999a35298da6afcdca99c1b64d6195abecd21962fd15dc4416

  • SHA512

    0b5451cb7597e843fb85d8c54cc6808d0a021e0176f0a525a7c2499f99faed5a7074c2884c5e15581a5bfd844f4d088836aac96aab63f3f210034dce66b30e39

Malware Config

Extracted

Family

redline

Botnet

25.11

C2

185.215.113.17:7700

Targets

    • Target

      3a29db8c7caf9d999a35298da6afcdca99c1b64d6195abecd21962fd15dc4416

    • Size

      284KB

    • MD5

      257225c69bce80a10227a6d158217989

    • SHA1

      eef104788d8ec248357868a1a8005308a900a87c

    • SHA256

      3a29db8c7caf9d999a35298da6afcdca99c1b64d6195abecd21962fd15dc4416

    • SHA512

      0b5451cb7597e843fb85d8c54cc6808d0a021e0176f0a525a7c2499f99faed5a7074c2884c5e15581a5bfd844f4d088836aac96aab63f3f210034dce66b30e39

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks