General

  • Target

    3c795310fba80298492c46fd2a284873.exe

  • Size

    107KB

  • Sample

    210511-485qm44v3a

  • MD5

    3c795310fba80298492c46fd2a284873

  • SHA1

    f057eb36c03c6d785d26bc6ca95d5d6f8f8ccda3

  • SHA256

    55fd4b535cce4249de23d8eb6c823f0f000e9e988c72a5a88d55353d84692271

  • SHA512

    40cabe677900de9eee08eea0b285dce689c18b5e2ab526d55d8983f19b14330f226d0a9d5d1f859c42f3f0cbdfcd5aa510c8a2c3d9ae0373f2f1b6e2f82470b0

Malware Config

Extracted

Family

redline

Botnet

@nTrill

C2

fastboomerzoomer.top:80

Targets

    • Target

      3c795310fba80298492c46fd2a284873.exe

    • Size

      107KB

    • MD5

      3c795310fba80298492c46fd2a284873

    • SHA1

      f057eb36c03c6d785d26bc6ca95d5d6f8f8ccda3

    • SHA256

      55fd4b535cce4249de23d8eb6c823f0f000e9e988c72a5a88d55353d84692271

    • SHA512

      40cabe677900de9eee08eea0b285dce689c18b5e2ab526d55d8983f19b14330f226d0a9d5d1f859c42f3f0cbdfcd5aa510c8a2c3d9ae0373f2f1b6e2f82470b0

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks