General

  • Target

    3353b7bfdc66c26ba230b41a1807f9eea8cef21059ce7958f9e637c6e6037b30

  • Size

    422KB

  • Sample

    220114-g3keaaefh4

  • MD5

    141862718c8950bd4d4441ed8fb74df1

  • SHA1

    28c41189a797b6a3738810efed88d409d6e49617

  • SHA256

    3353b7bfdc66c26ba230b41a1807f9eea8cef21059ce7958f9e637c6e6037b30

  • SHA512

    ea4488f5af12a04ed71e8d11a215c444bb16c74612235fc76988a4d6049d33edc3da79128b27a3269090400d1236e6a7fde84c8ef0e61f27edf8e61e51babff4

Malware Config

Extracted

Family

redline

Botnet

noname

C2

185.215.113.29:34865

Targets

    • Target

      3353b7bfdc66c26ba230b41a1807f9eea8cef21059ce7958f9e637c6e6037b30

    • Size

      422KB

    • MD5

      141862718c8950bd4d4441ed8fb74df1

    • SHA1

      28c41189a797b6a3738810efed88d409d6e49617

    • SHA256

      3353b7bfdc66c26ba230b41a1807f9eea8cef21059ce7958f9e637c6e6037b30

    • SHA512

      ea4488f5af12a04ed71e8d11a215c444bb16c74612235fc76988a4d6049d33edc3da79128b27a3269090400d1236e6a7fde84c8ef0e61f27edf8e61e51babff4

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks