General

  • Target

    73b26b61aaf78a737b9a87ed2131bba8.exe

  • Size

    1.8MB

  • Sample

    220414-yqdjmsdfhj

  • MD5

    73b26b61aaf78a737b9a87ed2131bba8

  • SHA1

    4cdee9388c06bbe2e764e4af9bff492255cce4ac

  • SHA256

    2373d2ff61cacf107f47ba5ca581f598d5276e2b55496bc2f8dfb676518d7338

  • SHA512

    987ce77ceb6bbbc5de54634ceb0492f4ab5675a66a684d003760b2a8ef8e88670e94109fe24e621a279962780a396d6a063512c685fb59e3aaf74412c5f4b52a

Malware Config

Extracted

Family

redline

Botnet

samka

C2

80.85.143.23:22842

Attributes
  • auth_value

    9436230551ccd65fcb2e5ea2f9c7b4d5

Targets

    • Target

      73b26b61aaf78a737b9a87ed2131bba8.exe

    • Size

      1.8MB

    • MD5

      73b26b61aaf78a737b9a87ed2131bba8

    • SHA1

      4cdee9388c06bbe2e764e4af9bff492255cce4ac

    • SHA256

      2373d2ff61cacf107f47ba5ca581f598d5276e2b55496bc2f8dfb676518d7338

    • SHA512

      987ce77ceb6bbbc5de54634ceb0492f4ab5675a66a684d003760b2a8ef8e88670e94109fe24e621a279962780a396d6a063512c685fb59e3aaf74412c5f4b52a

    • Meta Stealer Stealer

      Meta Stealer steals passwords stored in browsers, written in C++.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks