General

  • Target

    6bcb761064c6893e704a4115d654ac32046192d2aec4ff56b63eba2bacef7eea

  • Size

    388KB

  • Sample

    220625-zn1f3adfh9

  • MD5

    8daa424e046b2d902af7e167fc5b7ab8

  • SHA1

    328602b27097e400ad90a46708c2a131c4fff9a4

  • SHA256

    6bcb761064c6893e704a4115d654ac32046192d2aec4ff56b63eba2bacef7eea

  • SHA512

    78e48d608d8c81154c13ecd81bc886ebea3cf651fdcd3b3f92b413fa8c66014d0bbdb062a06b02139667e46730e6b8c6b2313fc6d2c19c3946b9cdf7ebdf0eb9

Malware Config

Extracted

Family

redline

Botnet

RUZKI

C2

193.106.191.246:23196

Attributes
  • auth_value

    121027c094f768a0a0e9b562f6417952

Targets

    • Target

      6bcb761064c6893e704a4115d654ac32046192d2aec4ff56b63eba2bacef7eea

    • Size

      388KB

    • MD5

      8daa424e046b2d902af7e167fc5b7ab8

    • SHA1

      328602b27097e400ad90a46708c2a131c4fff9a4

    • SHA256

      6bcb761064c6893e704a4115d654ac32046192d2aec4ff56b63eba2bacef7eea

    • SHA512

      78e48d608d8c81154c13ecd81bc886ebea3cf651fdcd3b3f92b413fa8c66014d0bbdb062a06b02139667e46730e6b8c6b2313fc6d2c19c3946b9cdf7ebdf0eb9

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks