General

  • Target

    https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa3lsRThocm9FcDVqWWJvdW1hMEY5VFBvLUlWQXxBQ3Jtc0trVktBRDJCMWpRNlgzZkdFZHZzR1EzODlKSFhUdzZzazdSV3dmR21FQlB0Zko4TzVHUGdTNGRuYmdvMGxLbklITFJGWWxVeE1zMGM3VHd2UG8wVWRRdTE0WXBmMVlOYnJycEpaT19IbUVzeVVmUDBmRQ&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Ffk8hywirwuutc%2FATMpengEx&v=UWLI-1DX_aY

  • Sample

    240914-w86a9syhnd

Malware Config

Extracted

Family

redline

C2

185.196.9.26:6302

Targets

    • Target

      https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa3lsRThocm9FcDVqWWJvdW1hMEY5VFBvLUlWQXxBQ3Jtc0trVktBRDJCMWpRNlgzZkdFZHZzR1EzODlKSFhUdzZzazdSV3dmR21FQlB0Zko4TzVHUGdTNGRuYmdvMGxLbklITFJGWWxVeE1zMGM3VHd2UG8wVWRRdTE0WXBmMVlOYnJycEpaT19IbUVzeVVmUDBmRQ&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Ffk8hywirwuutc%2FATMpengEx&v=UWLI-1DX_aY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks