General

  • Target

    b7685a9b44f02560330b862d17e77c98c28e2e815d8dcc39914864e0c3b613c0

  • Size

    422KB

  • Sample

    220115-24qynsfah8

  • MD5

    922accbb2575068ef2671dfe8b3ea36b

  • SHA1

    20073a1c6d5e0d1a5e55de11c6b4eb7e677b55a8

  • SHA256

    b7685a9b44f02560330b862d17e77c98c28e2e815d8dcc39914864e0c3b613c0

  • SHA512

    7b7fb4a6c4ed433984163017864d752f1879911ec1ca1ac5d3f8354bbf7df32b6e51c4da550ada986bf6fbf5a72c1840da3816ed4403e19a3c738d7a7d569eb6

Malware Config

Extracted

Family

redline

Botnet

noname

C2

185.215.113.29:34865

Targets

    • Target

      b7685a9b44f02560330b862d17e77c98c28e2e815d8dcc39914864e0c3b613c0

    • Size

      422KB

    • MD5

      922accbb2575068ef2671dfe8b3ea36b

    • SHA1

      20073a1c6d5e0d1a5e55de11c6b4eb7e677b55a8

    • SHA256

      b7685a9b44f02560330b862d17e77c98c28e2e815d8dcc39914864e0c3b613c0

    • SHA512

      7b7fb4a6c4ed433984163017864d752f1879911ec1ca1ac5d3f8354bbf7df32b6e51c4da550ada986bf6fbf5a72c1840da3816ed4403e19a3c738d7a7d569eb6

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks