General

  • Target

    28e2df8556bb1ead65a07f984113af78e1bfc3578c84acf714273658c00ef0fb

  • Size

    439KB

  • Sample

    220121-rv1reahgd3

  • MD5

    46737caa52b30fa405b1c3eb04293ddf

  • SHA1

    7cd75e7222a301e95e4a2a2b7335c21155929098

  • SHA256

    28e2df8556bb1ead65a07f984113af78e1bfc3578c84acf714273658c00ef0fb

  • SHA512

    58c24a7e202f1a817c3b176170aa490f35f618bd3c9be3aaa67f3770a8d0c97baf38273e14aa540702b68ec5459fe940e4f22a38b3fbf5165ef31132613a33f2

Malware Config

Extracted

Family

redline

Botnet

NONAME

C2

45.9.20.111:1355

Targets

    • Target

      28e2df8556bb1ead65a07f984113af78e1bfc3578c84acf714273658c00ef0fb

    • Size

      439KB

    • MD5

      46737caa52b30fa405b1c3eb04293ddf

    • SHA1

      7cd75e7222a301e95e4a2a2b7335c21155929098

    • SHA256

      28e2df8556bb1ead65a07f984113af78e1bfc3578c84acf714273658c00ef0fb

    • SHA512

      58c24a7e202f1a817c3b176170aa490f35f618bd3c9be3aaa67f3770a8d0c97baf38273e14aa540702b68ec5459fe940e4f22a38b3fbf5165ef31132613a33f2

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Tasks