General

  • Target

    ad05b43eb9d79233a12a79f8aecc64142d023b4a7fd5bef8b89ad8685f7cd858

  • Size

    423KB

  • Sample

    220114-tvh8gahdgr

  • MD5

    358b7f02da54fa14d68dbdc1afa590d3

  • SHA1

    7ab5cec2d56c80f044c1e02c16b7101dfdb9ab4e

  • SHA256

    ad05b43eb9d79233a12a79f8aecc64142d023b4a7fd5bef8b89ad8685f7cd858

  • SHA512

    36cea2dce2fff4cd8bb1f915b8aac324fbc50d6b5c97af38728ef721c10d0f7e9f04e72c9f80a49feec549b01e341db81f1da65adc0cbdf60aeb4e53ad7f0aaa

Malware Config

Extracted

Family

redline

Botnet

noname

C2

185.215.113.29:34865

Targets

    • Target

      ad05b43eb9d79233a12a79f8aecc64142d023b4a7fd5bef8b89ad8685f7cd858

    • Size

      423KB

    • MD5

      358b7f02da54fa14d68dbdc1afa590d3

    • SHA1

      7ab5cec2d56c80f044c1e02c16b7101dfdb9ab4e

    • SHA256

      ad05b43eb9d79233a12a79f8aecc64142d023b4a7fd5bef8b89ad8685f7cd858

    • SHA512

      36cea2dce2fff4cd8bb1f915b8aac324fbc50d6b5c97af38728ef721c10d0f7e9f04e72c9f80a49feec549b01e341db81f1da65adc0cbdf60aeb4e53ad7f0aaa

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks