General

  • Target

    f4834f340e0a567bcddb3c1e3b315f9fa8b018977105df1a58d0ee9f586d145e

  • Size

    384KB

  • Sample

    220212-mxgzvsbdd9

  • MD5

    e4a3d66e46118b654667a821b3749223

  • SHA1

    5649d6da1bcb63e301ef68a9506a573caea2b101

  • SHA256

    f4834f340e0a567bcddb3c1e3b315f9fa8b018977105df1a58d0ee9f586d145e

  • SHA512

    72a6e59c52423926cd8db6e3ddee714c931f1fc399a1667437839ca5398978efc587dffe3f8f1a429895c4ba200ca5ed5600157a6508e0c531016741738ac78d

Malware Config

Extracted

Family

redline

Botnet

ruzkiKAKOYTO

C2

185.215.113.29:20819

Attributes
  • auth_value

    44e87155dd7a4d1957a956ed040ff3fd

Targets

    • Target

      f4834f340e0a567bcddb3c1e3b315f9fa8b018977105df1a58d0ee9f586d145e

    • Size

      384KB

    • MD5

      e4a3d66e46118b654667a821b3749223

    • SHA1

      5649d6da1bcb63e301ef68a9506a573caea2b101

    • SHA256

      f4834f340e0a567bcddb3c1e3b315f9fa8b018977105df1a58d0ee9f586d145e

    • SHA512

      72a6e59c52423926cd8db6e3ddee714c931f1fc399a1667437839ca5398978efc587dffe3f8f1a429895c4ba200ca5ed5600157a6508e0c531016741738ac78d

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Tasks