General

  • Target

    85a01f994e4e297b81d170428f27e50d876cef9a634cc7e735388c39b5f1b51c

  • Size

    377KB

  • Sample

    220122-wr3h2sceb3

  • MD5

    c0410b4508f916b87967947f6dcde3a5

  • SHA1

    cc9bf4c46c058f6a9584c3960da83daa8683d446

  • SHA256

    85a01f994e4e297b81d170428f27e50d876cef9a634cc7e735388c39b5f1b51c

  • SHA512

    a6924cbd30db6708e95c8e600a8e232873292ec2e0e25eab5d13b784caf21614af36b1e4c71e003f90ab70fd76bd4fe20641a241619b01d624bd6f8cbcc1cecc

Malware Config

Extracted

Family

redline

Botnet

NONAME

C2

45.9.20.111:1355

Targets

    • Target

      85a01f994e4e297b81d170428f27e50d876cef9a634cc7e735388c39b5f1b51c

    • Size

      377KB

    • MD5

      c0410b4508f916b87967947f6dcde3a5

    • SHA1

      cc9bf4c46c058f6a9584c3960da83daa8683d446

    • SHA256

      85a01f994e4e297b81d170428f27e50d876cef9a634cc7e735388c39b5f1b51c

    • SHA512

      a6924cbd30db6708e95c8e600a8e232873292ec2e0e25eab5d13b784caf21614af36b1e4c71e003f90ab70fd76bd4fe20641a241619b01d624bd6f8cbcc1cecc

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Tasks