General

  • Target

    bca2e6292b5ed2ca4360347f96803d43.exe

  • Size

    383KB

  • Sample

    220523-p9sm8sded8

  • MD5

    bca2e6292b5ed2ca4360347f96803d43

  • SHA1

    33ff78733149fb69f08c93dc415807f01c729af7

  • SHA256

    11f864b4614cb3265b353220873deb49b07153a9d7547de3b15c2e95742a7798

  • SHA512

    2736a409834fa1239eda8a504b12f407a099b4f7e05f45be68ddf7d7ab94d5d78125e998ef76ef0d7a732c58727bcd1fc55b3284bcd533d8bf1c1aace3a91bfa

Malware Config

Extracted

Family

redline

Botnet

top

C2

185.215.113.75:81

Attributes
  • auth_value

    ff6259bc2baf33b54b454aad484fb0ee

Targets

    • Target

      bca2e6292b5ed2ca4360347f96803d43.exe

    • Size

      383KB

    • MD5

      bca2e6292b5ed2ca4360347f96803d43

    • SHA1

      33ff78733149fb69f08c93dc415807f01c729af7

    • SHA256

      11f864b4614cb3265b353220873deb49b07153a9d7547de3b15c2e95742a7798

    • SHA512

      2736a409834fa1239eda8a504b12f407a099b4f7e05f45be68ddf7d7ab94d5d78125e998ef76ef0d7a732c58727bcd1fc55b3284bcd533d8bf1c1aace3a91bfa

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks