General

  • Target

    4a45b900e7cd2b7cc46fa7b68238f054.exe

  • Size

    345KB

  • Sample

    220411-b6y4ysfddj

  • MD5

    4a45b900e7cd2b7cc46fa7b68238f054

  • SHA1

    86ab9705fc92ad0e46d354ac02a1bf3a4e3a8f0d

  • SHA256

    88d8c904915acdaaec8e8c801af2bbde838ea410f90d796c94913aac83119b13

  • SHA512

    591b7bc165c8e8a4fb6c1f7d6569de78f34a1deabccc131e46e040191e688fc8dc68607c4885ed8f2ac21ff6984f6939934701e321c09b48045d7b8f1806da05

Malware Config

Extracted

Family

redline

Botnet

50

C2

193.106.191.132:23196

Attributes
  • auth_value

    8735fcb130c82dd9d353478678d60bde

Targets

    • Target

      4a45b900e7cd2b7cc46fa7b68238f054.exe

    • Size

      345KB

    • MD5

      4a45b900e7cd2b7cc46fa7b68238f054

    • SHA1

      86ab9705fc92ad0e46d354ac02a1bf3a4e3a8f0d

    • SHA256

      88d8c904915acdaaec8e8c801af2bbde838ea410f90d796c94913aac83119b13

    • SHA512

      591b7bc165c8e8a4fb6c1f7d6569de78f34a1deabccc131e46e040191e688fc8dc68607c4885ed8f2ac21ff6984f6939934701e321c09b48045d7b8f1806da05

    • Meta Stealer Stealer

      Meta Stealer steals passwords stored in browsers, written in C++.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks