General

  • Target

    2668360cfd3bf4415e40049638365dcc.exe

  • Size

    366KB

  • Sample

    220412-skkswacghl

  • MD5

    2668360cfd3bf4415e40049638365dcc

  • SHA1

    5e6d7ba187ccf79de580d5b0329b13704776ab03

  • SHA256

    a4352096cac075b7c5c1f436c0ccc7703552265451e5decac88ac57622b65df1

  • SHA512

    068cd96d66b83c05d9ff8a8316199e5d55cb7d5cd4be16b4a7db7d82d9ce1e6c1d79544cdeb70e80b9953a22b19ec05d47e4071d212c381ea20896474a50853d

Malware Config

Extracted

Family

redline

Botnet

50

C2

193.106.191.153:23196

Attributes
  • auth_value

    8735fcb130c82dd9d353478678d60bde

Targets

    • Target

      2668360cfd3bf4415e40049638365dcc.exe

    • Size

      366KB

    • MD5

      2668360cfd3bf4415e40049638365dcc

    • SHA1

      5e6d7ba187ccf79de580d5b0329b13704776ab03

    • SHA256

      a4352096cac075b7c5c1f436c0ccc7703552265451e5decac88ac57622b65df1

    • SHA512

      068cd96d66b83c05d9ff8a8316199e5d55cb7d5cd4be16b4a7db7d82d9ce1e6c1d79544cdeb70e80b9953a22b19ec05d47e4071d212c381ea20896474a50853d

    • Meta Stealer Stealer

      Meta Stealer steals passwords stored in browsers, written in C++.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks