General

  • Target

    0003b3302020ca4f5bee7a61a772700a.exe

  • Size

    106KB

  • Sample

    220414-lpbx7sahgj

  • MD5

    0003b3302020ca4f5bee7a61a772700a

  • SHA1

    951e5d7a5eb78ea264799a90ca14579a4f0cbabe

  • SHA256

    baf77535e28c71f8fc047320497a589534e7d0f9598ec503b0a28e4015277998

  • SHA512

    e2cf5bc784c3ccfdf10ee326b86aa4d6ebc854131ea2410f8077c0dd4b0e554b908f9e2fb17446d489d746e7eb37e3200771452e144c5db16d41cfaf142bf93e

Malware Config

Extracted

Family

redline

Botnet

test

C2

2.58.149.187:8173

Attributes
  • auth_value

    dbf784967faac575a73c7df69d5266d4

Targets

    • Target

      0003b3302020ca4f5bee7a61a772700a.exe

    • Size

      106KB

    • MD5

      0003b3302020ca4f5bee7a61a772700a

    • SHA1

      951e5d7a5eb78ea264799a90ca14579a4f0cbabe

    • SHA256

      baf77535e28c71f8fc047320497a589534e7d0f9598ec503b0a28e4015277998

    • SHA512

      e2cf5bc784c3ccfdf10ee326b86aa4d6ebc854131ea2410f8077c0dd4b0e554b908f9e2fb17446d489d746e7eb37e3200771452e144c5db16d41cfaf142bf93e

    • Meta Stealer Stealer

      Meta Stealer steals passwords stored in browsers, written in C++.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks