General

  • Target

    4c0e459fe51caf92d61f677b8d12228c314d2c4be3084030f7b159d8524d8055

  • Size

    379KB

  • Sample

    220617-rhd2waege4

  • MD5

    41aa2d8645f76c0ce0c5d3862150fc78

  • SHA1

    ae0ddb329bd9d43c8b512d1afa1768c566ed81b5

  • SHA256

    4c0e459fe51caf92d61f677b8d12228c314d2c4be3084030f7b159d8524d8055

  • SHA512

    b6041c61d54245b2224d8e776e8be91431aa253442c831ead464c353b358270e52faeb8af9f6efcf6710f6140ee9820bb97fd83c607316699b8507c16ec669e4

Malware Config

Extracted

Family

redline

Botnet

META

C2

193.106.191.245:23196

Attributes
  • auth_value

    2ea67e19fe494687c77a179004b4a1c8

Targets

    • Target

      4c0e459fe51caf92d61f677b8d12228c314d2c4be3084030f7b159d8524d8055

    • Size

      379KB

    • MD5

      41aa2d8645f76c0ce0c5d3862150fc78

    • SHA1

      ae0ddb329bd9d43c8b512d1afa1768c566ed81b5

    • SHA256

      4c0e459fe51caf92d61f677b8d12228c314d2c4be3084030f7b159d8524d8055

    • SHA512

      b6041c61d54245b2224d8e776e8be91431aa253442c831ead464c353b358270e52faeb8af9f6efcf6710f6140ee9820bb97fd83c607316699b8507c16ec669e4

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks