General

  • Target

    4f7c9e23398e158ca029059a711d51d4494402e88f2fc1c4e05387a96636b1ff

  • Size

    361KB

  • Sample

    220925-f9vm6addg5

  • MD5

    7f3d7166aeed1fda0ef166e80e6dbec3

  • SHA1

    6be0eed0b5f612fd97f5b292d8b39c4d4da425e1

  • SHA256

    4f7c9e23398e158ca029059a711d51d4494402e88f2fc1c4e05387a96636b1ff

  • SHA512

    72e2c39f3b8e79a5395ce02547cc019009264557bd8652ac834854b93a8db22a9372d85c04a7d2459cd984addc5ad06c0d86430872a75cd187641318447fb325

  • SSDEEP

    6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv

Malware Config

Extracted

Family

redline

Botnet

0002

C2

13.72.81.58:13413

Attributes
  • auth_value

    866ce0ed8cfe2be77fb43a4912677698

Targets

    • Target

      4f7c9e23398e158ca029059a711d51d4494402e88f2fc1c4e05387a96636b1ff

    • Size

      361KB

    • MD5

      7f3d7166aeed1fda0ef166e80e6dbec3

    • SHA1

      6be0eed0b5f612fd97f5b292d8b39c4d4da425e1

    • SHA256

      4f7c9e23398e158ca029059a711d51d4494402e88f2fc1c4e05387a96636b1ff

    • SHA512

      72e2c39f3b8e79a5395ce02547cc019009264557bd8652ac834854b93a8db22a9372d85c04a7d2459cd984addc5ad06c0d86430872a75cd187641318447fb325

    • SSDEEP

      6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks