General

  • Target

    15dbc3f95ce875f143c0cebc2cd4dff7482f930779c7f5771d1d2a13ed0834ee

  • Size

    422KB

  • Sample

    220114-a1e88addg9

  • MD5

    335f408319cce3309986173266619751

  • SHA1

    a2943c14b18e18a432ee5a71f37629cf20b5f2b0

  • SHA256

    15dbc3f95ce875f143c0cebc2cd4dff7482f930779c7f5771d1d2a13ed0834ee

  • SHA512

    b058badd6d7e5072b67bf86c586040e70cf5443accebe11c7bf6662b34eedba50cc7b9c618e1db9aedaa2c9eb08d09906b118fb12f53358df6077ea10a8772a9

Malware Config

Extracted

Family

redline

Botnet

noname

C2

185.215.113.29:34865

Targets

    • Target

      15dbc3f95ce875f143c0cebc2cd4dff7482f930779c7f5771d1d2a13ed0834ee

    • Size

      422KB

    • MD5

      335f408319cce3309986173266619751

    • SHA1

      a2943c14b18e18a432ee5a71f37629cf20b5f2b0

    • SHA256

      15dbc3f95ce875f143c0cebc2cd4dff7482f930779c7f5771d1d2a13ed0834ee

    • SHA512

      b058badd6d7e5072b67bf86c586040e70cf5443accebe11c7bf6662b34eedba50cc7b9c618e1db9aedaa2c9eb08d09906b118fb12f53358df6077ea10a8772a9

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks