General

  • Target

    b1ba1f2096fcac1b8eb7d0688e5b876f29de776c0325021cec90808def4cfaf2

  • Size

    462KB

  • Sample

    220128-swvr8agad6

  • MD5

    93bab005393731dfaf7dff7a823ab497

  • SHA1

    136bdcc9c61878bb83895e130f24b90a76d220ab

  • SHA256

    b1ba1f2096fcac1b8eb7d0688e5b876f29de776c0325021cec90808def4cfaf2

  • SHA512

    cadc1f2fd8205bd40406856ecee4ca04e2759e7752d75e641255960ed923e25b623f906f33862fb8082a0b22c2304e3adce7fa3ec8021751d729ef3ef7db00c1

Malware Config

Extracted

Family

redline

Botnet

noname

C2

185.215.113.29:20819

Targets

    • Target

      b1ba1f2096fcac1b8eb7d0688e5b876f29de776c0325021cec90808def4cfaf2

    • Size

      462KB

    • MD5

      93bab005393731dfaf7dff7a823ab497

    • SHA1

      136bdcc9c61878bb83895e130f24b90a76d220ab

    • SHA256

      b1ba1f2096fcac1b8eb7d0688e5b876f29de776c0325021cec90808def4cfaf2

    • SHA512

      cadc1f2fd8205bd40406856ecee4ca04e2759e7752d75e641255960ed923e25b623f906f33862fb8082a0b22c2304e3adce7fa3ec8021751d729ef3ef7db00c1

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Tasks