General

  • Target

    77fb56f60d9d5cbb230f0b2a07f89770.exe

  • Size

    345KB

  • Sample

    220411-fkn43sdag3

  • MD5

    77fb56f60d9d5cbb230f0b2a07f89770

  • SHA1

    5aef5b479e154c68ebe04a723f37be8fc558af99

  • SHA256

    311522dc27e0de5a20712678203bd63b3012a7ddf4443a8f177b61d537ff6dbb

  • SHA512

    025e8a227b2060448c10f31f9e50d4c02341a3a7a1db4986d0a2c2fb52275536239007a3338046c6d322396a319e99e24358aeb0d2eb3ede82b6acdad4e8b85d

Malware Config

Extracted

Family

redline

Botnet

50

C2

193.106.191.132:23196

Attributes
  • auth_value

    8735fcb130c82dd9d353478678d60bde

Targets

    • Target

      77fb56f60d9d5cbb230f0b2a07f89770.exe

    • Size

      345KB

    • MD5

      77fb56f60d9d5cbb230f0b2a07f89770

    • SHA1

      5aef5b479e154c68ebe04a723f37be8fc558af99

    • SHA256

      311522dc27e0de5a20712678203bd63b3012a7ddf4443a8f177b61d537ff6dbb

    • SHA512

      025e8a227b2060448c10f31f9e50d4c02341a3a7a1db4986d0a2c2fb52275536239007a3338046c6d322396a319e99e24358aeb0d2eb3ede82b6acdad4e8b85d

    • Meta Stealer Stealer

      Meta Stealer steals passwords stored in browsers, written in C++.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks