General

  • Target

    5f364c015a5bd824a4ef8090ed5df4204f1bb371aece3a6d47d054e33207ead8

  • Size

    376KB

  • Sample

    220123-dp5araedf8

  • MD5

    cb81560c55852bd5c3ddcce11d6c8448

  • SHA1

    536174f62fae20d3d227319b21c8b2ba5fbb378a

  • SHA256

    5f364c015a5bd824a4ef8090ed5df4204f1bb371aece3a6d47d054e33207ead8

  • SHA512

    101afa27e46fc0a7462698957de9fcfee361e0595143dc894ee45fafe4e66a1d8d244cd70e01a8562ccf8cced1c1b511c6e486c79a9ceb1ccbb46e747f2ff8c0

Malware Config

Extracted

Family

redline

Botnet

NONAME

C2

45.9.20.111:1355

Targets

    • Target

      5f364c015a5bd824a4ef8090ed5df4204f1bb371aece3a6d47d054e33207ead8

    • Size

      376KB

    • MD5

      cb81560c55852bd5c3ddcce11d6c8448

    • SHA1

      536174f62fae20d3d227319b21c8b2ba5fbb378a

    • SHA256

      5f364c015a5bd824a4ef8090ed5df4204f1bb371aece3a6d47d054e33207ead8

    • SHA512

      101afa27e46fc0a7462698957de9fcfee361e0595143dc894ee45fafe4e66a1d8d244cd70e01a8562ccf8cced1c1b511c6e486c79a9ceb1ccbb46e747f2ff8c0

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Tasks