https://0xblack.dev/research/Recent content in Research on 0xblackHugoen-usTue, 18 Mar 2025 00:00:00 +0000https://0xblack.dev/research/redline-v5-credential-harvesting/Tue, 18 Mar 2025 00:00:00 +0000https://0xblack.dev/research/redline-v5-credential-harvesting/<h2 id="executive-summary">Executive Summary</h2> <p>RedLine Stealer v5 is a commodity credential-harvesting malware distributed through malvertising campaigns promoting fake software installers (notably cracked games and productivity tools). Upon execution, it extracts browser-saved passwords, cookies, cryptocurrency wallets, and Discord tokens before exfiltrating them to a C2 panel. This sample was built using the leaked RedLine builder and sold as MaaS (Malware-as-a-Service).</p> <h2 id="sample-information">Sample Information</h2> <table> <thead> <tr> <th>Field</th> <th>Value</th> </tr> </thead> <tbody> <tr> <td>File Name</td> <td><code>AdobeInstaller_crack.exe</code></td> </tr> <tr> <td>File Type</td> <td>PE32 executable (GUI)</td> </tr> <tr> <td>Size</td> <td>612 KB</td> </tr> <tr> <td>Compiler</td> <td>.NET 4.8</td> </tr> <tr> <td>Packer</td> <td>ConfuserEx (obfuscation)</td> </tr> <tr> <td>First Seen</td> <td>2025-03-10 (VirusTotal)</td> </tr> <tr> <td>VT Score</td> <td>47 / 72</td> </tr> </tbody> </table> <h2 id="static-analysis">Static Analysis</h2> <p>DIE (Detect-It-Easy) identified the sample as a .NET assembly with ConfuserEx obfuscation applied. PE-bear showed no obvious packing but the import table was minimal and consistent with .NET managed code.</p>