General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.10927.6350.exe

  • Size

    497KB

  • Sample

    231023-a33gjafd34

  • MD5

    e27130f8063f5254139884dfea6e03eb

  • SHA1

    91734b4bf7920e68c4d48fdeff7cba47fc561e7a

  • SHA256

    e0f8898a3b8a28586efe65e9afa0c08e252d3b41f1380ebbb93d3226dc5eae34

  • SHA512

    dc4d354be423238f0a4e9ddfcfa870f2e1ff07b26a447d2b963c63b4ebfdd9e218d39a42263094cb90c343d35bd864ef299877addfae97d7a934bf5132724337

  • SSDEEP

    6144:w/HGQrV8JDPMT2/vpUOXia60CoOO5R2ZnxQdLTJFb246eQB8ApxANh:uGQCLMUvpUOXia60C3O5R2sdLu4uBPCL

Malware Config

Targets

    • Target

      SecuriteInfo.com.Win32.PWSX-gen.10927.6350.exe

    • Size

      497KB

    • MD5

      e27130f8063f5254139884dfea6e03eb

    • SHA1

      91734b4bf7920e68c4d48fdeff7cba47fc561e7a

    • SHA256

      e0f8898a3b8a28586efe65e9afa0c08e252d3b41f1380ebbb93d3226dc5eae34

    • SHA512

      dc4d354be423238f0a4e9ddfcfa870f2e1ff07b26a447d2b963c63b4ebfdd9e218d39a42263094cb90c343d35bd864ef299877addfae97d7a934bf5132724337

    • SSDEEP

      6144:w/HGQrV8JDPMT2/vpUOXia60CoOO5R2ZnxQdLTJFb246eQB8ApxANh:uGQCLMUvpUOXia60C3O5R2sdLu4uBPCL

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks