General

  • Target

    60c85fce1fbb2d9aaf9737335785e6c0c55b1e42a45394aa7c408b93f2b9bdf0

  • Size

    926KB

  • Sample

    220923-g69tcaddb3

  • MD5

    661a6a25cbdbec6543e74fae455e349a

  • SHA1

    c5486f079370b7a0b2c1dbd170035ce25da8163e

  • SHA256

    60c85fce1fbb2d9aaf9737335785e6c0c55b1e42a45394aa7c408b93f2b9bdf0

  • SHA512

    b2514f2f29d73a41a4c26c81c1997dd3cd91258461b71da86e7cfe6f02d416cd13d11747be9b274a612b08544cd4389b7c2f0337a4a2b020d7c5e8babf51bb5b

  • SSDEEP

    12288:taxffztFbbNiQoNS+2pvdNbbM3wBirlBQYg3fLLD:taxHzvwQoNS+q/bbswBirPQYgvD

Malware Config

Extracted

Family

redline

Botnet

mag21

C2

jamesmillion.xyz:47481

Attributes
  • auth_value

    b5ecf039f4b13b472d3c95fc6fe41fc8

Targets

    • Target

      60c85fce1fbb2d9aaf9737335785e6c0c55b1e42a45394aa7c408b93f2b9bdf0

    • Size

      926KB

    • MD5

      661a6a25cbdbec6543e74fae455e349a

    • SHA1

      c5486f079370b7a0b2c1dbd170035ce25da8163e

    • SHA256

      60c85fce1fbb2d9aaf9737335785e6c0c55b1e42a45394aa7c408b93f2b9bdf0

    • SHA512

      b2514f2f29d73a41a4c26c81c1997dd3cd91258461b71da86e7cfe6f02d416cd13d11747be9b274a612b08544cd4389b7c2f0337a4a2b020d7c5e8babf51bb5b

    • SSDEEP

      12288:taxffztFbbNiQoNS+2pvdNbbM3wBirlBQYg3fLLD:taxHzvwQoNS+q/bbswBirPQYgvD

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Tasks