General

  • Target

    bf7b005e3b789a8b6c8b4af07e676d4681b43b4e94bf385673eba8401c39a6a4

  • Size

    399KB

  • Sample

    220130-xfdwzsgfdj

  • MD5

    fed47851fe1febbc0fb0e134617da2b5

  • SHA1

    083a0dc0e5e0353cb66d9b6b9e01730c361bf7f1

  • SHA256

    bf7b005e3b789a8b6c8b4af07e676d4681b43b4e94bf385673eba8401c39a6a4

  • SHA512

    c03c88396d13a6a4b10ba0c9492c36255b1847b2f24917e14fe67da233fea28397f628a7d71ffa0c096deeff1b7cc13a3e8b8273e4608b118a423eecf4e87854

Malware Config

Extracted

Family

redline

Botnet

noname

C2

185.215.113.29:20819

Targets

    • Target

      bf7b005e3b789a8b6c8b4af07e676d4681b43b4e94bf385673eba8401c39a6a4

    • Size

      399KB

    • MD5

      fed47851fe1febbc0fb0e134617da2b5

    • SHA1

      083a0dc0e5e0353cb66d9b6b9e01730c361bf7f1

    • SHA256

      bf7b005e3b789a8b6c8b4af07e676d4681b43b4e94bf385673eba8401c39a6a4

    • SHA512

      c03c88396d13a6a4b10ba0c9492c36255b1847b2f24917e14fe67da233fea28397f628a7d71ffa0c096deeff1b7cc13a3e8b8273e4608b118a423eecf4e87854

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Tasks