General

  • Target

    e12d3a83887b4bcc93f741dbec765bd7b7939f1288e51fd6dd0106cb8e0ee1ed

  • Size

    388KB

  • Sample

    220626-k5vjtaccg6

  • MD5

    2f52bdeab42ffcb95104800f4021e06e

  • SHA1

    c31533d389ec16c9a5c2c2afd5ae9b5c3e74d868

  • SHA256

    e12d3a83887b4bcc93f741dbec765bd7b7939f1288e51fd6dd0106cb8e0ee1ed

  • SHA512

    306d82b3ecf21bcdbd2ffd3cd9c7c7da9744c8728d2527f9433fcde59b4d01117dac6d45ff3580f2fe52b9562a2816551aa9f54e3afbc57bbd67246544ec92a8

Malware Config

Extracted

Family

redline

Botnet

RUZKI

C2

193.106.191.246:23196

Attributes
  • auth_value

    121027c094f768a0a0e9b562f6417952

Targets

    • Target

      e12d3a83887b4bcc93f741dbec765bd7b7939f1288e51fd6dd0106cb8e0ee1ed

    • Size

      388KB

    • MD5

      2f52bdeab42ffcb95104800f4021e06e

    • SHA1

      c31533d389ec16c9a5c2c2afd5ae9b5c3e74d868

    • SHA256

      e12d3a83887b4bcc93f741dbec765bd7b7939f1288e51fd6dd0106cb8e0ee1ed

    • SHA512

      306d82b3ecf21bcdbd2ffd3cd9c7c7da9744c8728d2527f9433fcde59b4d01117dac6d45ff3580f2fe52b9562a2816551aa9f54e3afbc57bbd67246544ec92a8

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks