General

  • Target

    8f3120dda00cf636fc9b3c0e943ff8ef.exe

  • Size

    367KB

  • Sample

    220411-gdeshaadbq

  • MD5

    8f3120dda00cf636fc9b3c0e943ff8ef

  • SHA1

    77f04c4021e94104e756d9345f56032f338414d1

  • SHA256

    31d2646ce062a95e9aecd01bab72221fec3947aa79b82a95840ff09cf676da4c

  • SHA512

    8732d4d5d6d77225d9a03d63c70531f0ddadc0bcce293643cba7e10058d8a45b908635fbaa78edcfef4f539aab57335e54d1e897d65aaa6e43c4c8aa569ff730

Malware Config

Extracted

Family

redline

Botnet

50

C2

193.106.191.132:23196

Attributes
  • auth_value

    8735fcb130c82dd9d353478678d60bde

Targets

    • Target

      8f3120dda00cf636fc9b3c0e943ff8ef.exe

    • Size

      367KB

    • MD5

      8f3120dda00cf636fc9b3c0e943ff8ef

    • SHA1

      77f04c4021e94104e756d9345f56032f338414d1

    • SHA256

      31d2646ce062a95e9aecd01bab72221fec3947aa79b82a95840ff09cf676da4c

    • SHA512

      8732d4d5d6d77225d9a03d63c70531f0ddadc0bcce293643cba7e10058d8a45b908635fbaa78edcfef4f539aab57335e54d1e897d65aaa6e43c4c8aa569ff730

    • Meta Stealer Stealer

      Meta Stealer steals passwords stored in browsers, written in C++.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks