General
-
Target
9511dc0748924375cf62e19e57c721e9965bbee4d0b509db382a492d5873db29
-
Size
328KB
-
Sample
220127-lw5h4aahh3
-
MD5
3f5f3af3b5f8d722547cd9b30960e0ba
-
SHA1
47d78e2a46c341c78d3dd81cae7934809e7b8014
-
SHA256
9511dc0748924375cf62e19e57c721e9965bbee4d0b509db382a492d5873db29
-
SHA512
5e2772c61a8f94a3f3db3742e1a5af7a229dff6bb71ba3019484ead1d28c5be728a1289dc1ec0770072f147178ad6f5f9cf3685d5c3aaf576ade44ef3497adbd
Static task
static1
Behavioral task
behavioral1
Sample
9511dc0748924375cf62e19e57c721e9965bbee4d0b509db382a492d5873db29.exe
Resource
win10-en-20211208
Malware Config
Extracted
redline
ruzkiKAKOYTO
185.215.113.29:20819
Targets
-
-
Target
9511dc0748924375cf62e19e57c721e9965bbee4d0b509db382a492d5873db29
-
Size
328KB
-
MD5
3f5f3af3b5f8d722547cd9b30960e0ba
-
SHA1
47d78e2a46c341c78d3dd81cae7934809e7b8014
-
SHA256
9511dc0748924375cf62e19e57c721e9965bbee4d0b509db382a492d5873db29
-
SHA512
5e2772c61a8f94a3f3db3742e1a5af7a229dff6bb71ba3019484ead1d28c5be728a1289dc1ec0770072f147178ad6f5f9cf3685d5c3aaf576ade44ef3497adbd
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
MITRE ATT&CK Matrix
Collection
Data from Local System
1Command and Control
Credential Access
Credentials in Files
1Defense Evasion
Discovery
Query Registry
1Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation