General

  • Target

    46e8d708dc04512fa883784a27ee9b894668a4cabffe9714ce6d02adc508a010

  • Size

    421KB

  • Sample

    220201-jn7x5sbef8

  • MD5

    12b7968d22cb2ba2e0ddb90cc4c41bdd

  • SHA1

    4e3bdb9ff06d49c110dc4b1a5c698c527c3a31f6

  • SHA256

    46e8d708dc04512fa883784a27ee9b894668a4cabffe9714ce6d02adc508a010

  • SHA512

    92cfdf2799da9ae0d0d57813c26cccfc9e177119935e3b8e2cad25e19f0ba1f553822742925c26b4a9ddf52c86270988e1df24f441aeb2fefb1fad6beeaf48eb

Malware Config

Extracted

Family

redline

Botnet

noname

C2

185.215.113.29:20819

Targets

    • Target

      46e8d708dc04512fa883784a27ee9b894668a4cabffe9714ce6d02adc508a010

    • Size

      421KB

    • MD5

      12b7968d22cb2ba2e0ddb90cc4c41bdd

    • SHA1

      4e3bdb9ff06d49c110dc4b1a5c698c527c3a31f6

    • SHA256

      46e8d708dc04512fa883784a27ee9b894668a4cabffe9714ce6d02adc508a010

    • SHA512

      92cfdf2799da9ae0d0d57813c26cccfc9e177119935e3b8e2cad25e19f0ba1f553822742925c26b4a9ddf52c86270988e1df24f441aeb2fefb1fad6beeaf48eb

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Tasks