General

  • Target

    b0f517a03350ae3158d347218a183c2bab1b7a5b2ec7bc5b7287569000665191

  • Size

    431KB

  • Sample

    220115-snretsefe2

  • MD5

    1b44d7f1f21b4ff6c8103266582ab0e0

  • SHA1

    fc19d79d951ed5ff1389518139037a2e10cbaac0

  • SHA256

    b0f517a03350ae3158d347218a183c2bab1b7a5b2ec7bc5b7287569000665191

  • SHA512

    baa3d6d7a6a3b078ddfa4e3813f0b6d4dd2d96ca8ba0357ce828ebb19805267bd89feaa1df4c07db77320ddafa46bd3e5b48278e6abac949f22091111d363033

Malware Config

Extracted

Family

redline

Botnet

noname

C2

185.215.113.29:34865

Targets

    • Target

      b0f517a03350ae3158d347218a183c2bab1b7a5b2ec7bc5b7287569000665191

    • Size

      431KB

    • MD5

      1b44d7f1f21b4ff6c8103266582ab0e0

    • SHA1

      fc19d79d951ed5ff1389518139037a2e10cbaac0

    • SHA256

      b0f517a03350ae3158d347218a183c2bab1b7a5b2ec7bc5b7287569000665191

    • SHA512

      baa3d6d7a6a3b078ddfa4e3813f0b6d4dd2d96ca8ba0357ce828ebb19805267bd89feaa1df4c07db77320ddafa46bd3e5b48278e6abac949f22091111d363033

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks