0xblack

RedLine Stealer v5 — Credential Harvesting via Fake Software Installers

Tue, 18 Mar 2025 00:00:00 +0000

Executive Summary

RedLine Stealer v5 is a commodity credential-harvesting malware distributed through malvertising campaigns promoting fake software installers (notably cracked games and productivity tools). Upon execution, it extracts browser-saved passwords, cookies, cryptocurrency wallets, and Discord tokens before exfiltrating them to a C2 panel. This sample was built using the leaked RedLine builder and sold as MaaS (Malware-as-a-Service).

Sample Information

Field	Value
File Name	`AdobeInstaller_crack.exe`
File Type	PE32 executable (GUI)
Size	612 KB
Compiler	.NET 4.8
Packer	ConfuserEx (obfuscation)
First Seen	2025-03-10 (VirusTotal)
VT Score	47 / 72

Static Analysis

DIE (Detect-It-Easy) identified the sample as a .NET assembly with ConfuserEx obfuscation applied. PE-bear showed no obvious packing but the import table was minimal and consistent with .NET managed code.

DawgCTF - Data Needs Splitting Write-up

Fri, 17 Apr 2026 20:17:16 +0300

In this blog I will be sharing my insights and solution about the problem “Data Needs Splitting” from DawgCTF that I’ve attended a few days ago with my team.

The problem statement

As you can see we are given a domain called data-needs-splitting.umbccd.net, but as the problem stating that “However you need to find it first” we directly understood that this domain actually doesn’t give us any response when we send a GET request to it.

Setting Up a Malware Analysis Lab on a Budget

Sat, 01 Mar 2025 00:00:00 +0000

One of the first questions people ask when getting into malware analysis is: how do I set up a safe environment to run samples without destroying my main machine? This is a fair concern — executing unknown binaries carelessly is how analysts end up with infected hosts.

Here’s exactly what my setup looks like, how I built it cheaply, and the mistakes I made early on so you don’t have to.