bbf5d1777679718aef60a9b9cfd16ab3fce9eed87c1b4ad357310b9175b1bf90

General
Target

bbf5d1777679718aef60a9b9cfd16ab3fce9eed87c1b4ad357310b9175b1bf90

Size

116KB

Sample

210926-rg4k5sehg5

Score
10 /10
MD5

8da26029b1c8475f9ff8ecc59efc6d07

SHA1

e6079af56715830324fbda79914e03452a43956f

SHA256

bbf5d1777679718aef60a9b9cfd16ab3fce9eed87c1b4ad357310b9175b1bf90

SHA512

505521da80ab39c9b7647214cf0ab0f94ade6bdb20ea4b51dcd2820e597b937a69b786a2d99464270e6de0af95ec44859f12adb0baf287e0a7d4c043527f1665

Malware Config

Extracted

Family redline
Botnet 13367
C2

94.250.250.77:32413

Targets
Target

bbf5d1777679718aef60a9b9cfd16ab3fce9eed87c1b4ad357310b9175b1bf90

MD5

8da26029b1c8475f9ff8ecc59efc6d07

Filesize

116KB

Score
7 /10
SHA1

e6079af56715830324fbda79914e03452a43956f

SHA256

bbf5d1777679718aef60a9b9cfd16ab3fce9eed87c1b4ad357310b9175b1bf90

SHA512

505521da80ab39c9b7647214cf0ab0f94ade6bdb20ea4b51dcd2820e597b937a69b786a2d99464270e6de0af95ec44859f12adb0baf287e0a7d4c043527f1665

Tags

Signatures

  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Accesses cryptocurrency files/wallets, possible credential harvesting

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry

Related Tasks

MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Discovery
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                  Privilege Escalation
                    Tasks

                    static1

                    10/10

                    behavioral1

                    7/10