General

  • Target

    e46f80ad123b84740d3fa93c510f4d6b.exe

  • Size

    397KB

  • Sample

    220813-g52fkshah7

  • MD5

    e46f80ad123b84740d3fa93c510f4d6b

  • SHA1

    a38a7536dbe67be239178f744f49592b6f57dd78

  • SHA256

    8f00e9b2c63600af5efc5f6b5bf9e0ace5fbd18f6bd812f2f82b268a90b6f88b

  • SHA512

    6634a7f526e4e4bee7d883c1585a84dc3036ef5b843304dde73bf977807edb97f7eab1a5061f718a9d96db795bc57dc29047e5d0ac43e7961928b610da5ab89f

Malware Config

Extracted

Family

redline

Botnet

ruzki

C2

193.106.191.165:39482

Attributes
  • auth_value

    71a0558c0eea274a5bd617ea85786884

Targets

    • Target

      e46f80ad123b84740d3fa93c510f4d6b.exe

    • Size

      397KB

    • MD5

      e46f80ad123b84740d3fa93c510f4d6b

    • SHA1

      a38a7536dbe67be239178f744f49592b6f57dd78

    • SHA256

      8f00e9b2c63600af5efc5f6b5bf9e0ace5fbd18f6bd812f2f82b268a90b6f88b

    • SHA512

      6634a7f526e4e4bee7d883c1585a84dc3036ef5b843304dde73bf977807edb97f7eab1a5061f718a9d96db795bc57dc29047e5d0ac43e7961928b610da5ab89f

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks