General

  • Target

    0e22228b1d3b93354a60b800f41e0d27842aa797b2dfccc78c3357c0dcd507a6

  • Size

    376KB

  • Sample

    220122-11t1gsdeam

  • MD5

    694a636e3ded7dda8024ca87352c751e

  • SHA1

    68b2210bc118be80f6507c118fc11900ac945e1e

  • SHA256

    0e22228b1d3b93354a60b800f41e0d27842aa797b2dfccc78c3357c0dcd507a6

  • SHA512

    a2ab7ee52c95e3089fb9af9d76b03bd02e7f37ad2470cd8c7c95fb4363db6093b9c6ec5834a22e917d71d7718ca20597fead5581701c9a5853925d227b4c3a10

Malware Config

Extracted

Family

redline

Botnet

NONAME

C2

45.9.20.111:1355

Targets

    • Target

      0e22228b1d3b93354a60b800f41e0d27842aa797b2dfccc78c3357c0dcd507a6

    • Size

      376KB

    • MD5

      694a636e3ded7dda8024ca87352c751e

    • SHA1

      68b2210bc118be80f6507c118fc11900ac945e1e

    • SHA256

      0e22228b1d3b93354a60b800f41e0d27842aa797b2dfccc78c3357c0dcd507a6

    • SHA512

      a2ab7ee52c95e3089fb9af9d76b03bd02e7f37ad2470cd8c7c95fb4363db6093b9c6ec5834a22e917d71d7718ca20597fead5581701c9a5853925d227b4c3a10

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Tasks