General

  • Target

    NEAS.NEAScc7bcdfee502f5cc0c042b3a97ef737afa5cccb46a2dadaa02bcf74faf6fd8acexeexe_JC.exe

  • Size

    510KB

  • Sample

    231021-xbwk8sad77

  • MD5

    d9b1b6a00bc3cfb5ed1127e2918d4d32

  • SHA1

    61c339471846fae15ca49e8dce53fd119871ae36

  • SHA256

    cc7bcdfee502f5cc0c042b3a97ef737afa5cccb46a2dadaa02bcf74faf6fd8ac

  • SHA512

    c837989714587f72ee1d0256233f65a3a6291d1b46a1e5e4f3320c98d133a55f2fea4e352f7c9b6839cff1b1837294caaad80f57ca2a15bf5abb08a14cbff1c4

  • SSDEEP

    12288:P+YdcV/e6zs8hc5qf5IsEV1JtYbXwrS+GzZFVy9pUcuP+VRpL:HMe6oN5rdV1sjML

Malware Config

Targets

    • Target

      NEAS.NEAScc7bcdfee502f5cc0c042b3a97ef737afa5cccb46a2dadaa02bcf74faf6fd8acexeexe_JC.exe

    • Size

      510KB

    • MD5

      d9b1b6a00bc3cfb5ed1127e2918d4d32

    • SHA1

      61c339471846fae15ca49e8dce53fd119871ae36

    • SHA256

      cc7bcdfee502f5cc0c042b3a97ef737afa5cccb46a2dadaa02bcf74faf6fd8ac

    • SHA512

      c837989714587f72ee1d0256233f65a3a6291d1b46a1e5e4f3320c98d133a55f2fea4e352f7c9b6839cff1b1837294caaad80f57ca2a15bf5abb08a14cbff1c4

    • SSDEEP

      12288:P+YdcV/e6zs8hc5qf5IsEV1JtYbXwrS+GzZFVy9pUcuP+VRpL:HMe6oN5rdV1sjML

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks