General

  • Target

    e3ab78987f440064f45cbfa5802cefb08d7a7de3d9fa0ee003710ce2c1625abb

  • Size

    422KB

  • Sample

    220115-prwxyaeefq

  • MD5

    b75ae64384ab5cd500a86caac4ccca5e

  • SHA1

    7441e744571fa55c656609712848244985b64b68

  • SHA256

    e3ab78987f440064f45cbfa5802cefb08d7a7de3d9fa0ee003710ce2c1625abb

  • SHA512

    c25ff585bbd0f2d7a2a0d378f0c9bd89d0c15467f0fbbeeee1a1ae3b8be9191e52131fd0aa14568805db8a8c7a22d6ccb7f9758bd9d8eb97661464cb798b78bb

Malware Config

Extracted

Family

redline

Botnet

noname

C2

185.215.113.29:34865

Targets

    • Target

      e3ab78987f440064f45cbfa5802cefb08d7a7de3d9fa0ee003710ce2c1625abb

    • Size

      422KB

    • MD5

      b75ae64384ab5cd500a86caac4ccca5e

    • SHA1

      7441e744571fa55c656609712848244985b64b68

    • SHA256

      e3ab78987f440064f45cbfa5802cefb08d7a7de3d9fa0ee003710ce2c1625abb

    • SHA512

      c25ff585bbd0f2d7a2a0d378f0c9bd89d0c15467f0fbbeeee1a1ae3b8be9191e52131fd0aa14568805db8a8c7a22d6ccb7f9758bd9d8eb97661464cb798b78bb

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks