General

  • Target
    959df853a03cc48a3c5b3e2f541943ff.exe
  • Size 392KB
  • Sample220904-b1e4wsgagj
  • SHA256 fd182dfc99b5055afee5c281a511c9b8c5716af9767a9e78e9eec90e0edeb1da
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • redline

Botnet
  • twick

C2
  • trustedwicky.com:80

Attributes
  • auth_value

    2284521981f16053dae08194ef371cb3

Targets

    • Target
      959df853a03cc48a3c5b3e2f541943ff.exe
    • Size 392KB
    • SHA256 fd182dfc99b5055afee5c281a511c9b8c5716af9767a9e78e9eec90e0edeb1da
    • MD5 SHA1 SHA512 SSDEEP
    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks