General

  • Target

    bba7db09449a22cfe8f3310bf1238210.exe

  • Size

    371KB

  • Sample

    220514-qwslrahhc5

  • MD5

    bba7db09449a22cfe8f3310bf1238210

  • SHA1

    49ce80fb77d7a06c4de52ddf2457e1dfceb7661c

  • SHA256

    ffd0e59168d8d32c26f16e557b26d7fc45a748ae3d2621f40c740848762249a6

  • SHA512

    930a6dae0d84521584022956aa8f6fffc2f1bd17d4b009647fd23dfc600da9936360ac56f3b5c393a9a61e1f6f1c9846d29b3786f6713383c7cf060653fc5168

Malware Config

Extracted

Family

redline

Botnet

swttestmet

C2

185.215.113.75:4531

Attributes
  • auth_value

    adc5dc30debab8d39a706f26a199fa7e

Targets

    • Target

      bba7db09449a22cfe8f3310bf1238210.exe

    • Size

      371KB

    • MD5

      bba7db09449a22cfe8f3310bf1238210

    • SHA1

      49ce80fb77d7a06c4de52ddf2457e1dfceb7661c

    • SHA256

      ffd0e59168d8d32c26f16e557b26d7fc45a748ae3d2621f40c740848762249a6

    • SHA512

      930a6dae0d84521584022956aa8f6fffc2f1bd17d4b009647fd23dfc600da9936360ac56f3b5c393a9a61e1f6f1c9846d29b3786f6713383c7cf060653fc5168

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks