General

  • Target

    115cc65e91a90be872ac728e0e377d86.exe

  • Size

    363KB

  • Sample

    220412-xprt7sfbhk

  • MD5

    115cc65e91a90be872ac728e0e377d86

  • SHA1

    f975b56f9b3edcfe318e889a33ef24031cc26570

  • SHA256

    8930f6f934a64dcf090b74709b4ea5863559adf17ac180cca74eaa06d7e1c22d

  • SHA512

    de399be5769dbfeb51b0abff35e6e67b5ef59a81b335918cf1ee701c907c0e476b7f067f7646b4ab71e6b01cc071773ef94f3d2d01141b67959c356cf4ddca9f

Malware Config

Extracted

Family

redline

Botnet

50

C2

193.106.191.153:23196

Attributes
  • auth_value

    8735fcb130c82dd9d353478678d60bde

Targets

    • Target

      115cc65e91a90be872ac728e0e377d86.exe

    • Size

      363KB

    • MD5

      115cc65e91a90be872ac728e0e377d86

    • SHA1

      f975b56f9b3edcfe318e889a33ef24031cc26570

    • SHA256

      8930f6f934a64dcf090b74709b4ea5863559adf17ac180cca74eaa06d7e1c22d

    • SHA512

      de399be5769dbfeb51b0abff35e6e67b5ef59a81b335918cf1ee701c907c0e476b7f067f7646b4ab71e6b01cc071773ef94f3d2d01141b67959c356cf4ddca9f

    • Meta Stealer Stealer

      Meta Stealer steals passwords stored in browsers, written in C++.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks