General

  • Target

    aef796d69764f3cbe50f3f3a873596cdc0a5a1734fa1d7bf36dd0d517cf9a667

  • Size

    361KB

  • Sample

    220925-gpexmsegem

  • MD5

    bb6e76cd2783d7a6531765dcc2162d9e

  • SHA1

    bbe9ec24ac1a4a6f3cd242aade4e2137021171be

  • SHA256

    aef796d69764f3cbe50f3f3a873596cdc0a5a1734fa1d7bf36dd0d517cf9a667

  • SHA512

    2396b34f01111acf5bbdd60150ac01d870c2714d4d83071b8088939c6ab589f06d89d700c1d2093032f7ea0510e6dac2001b41681f1d45a786d02a27da39a2df

  • SSDEEP

    6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv

Malware Config

Extracted

Family

redline

Botnet

0002

C2

13.72.81.58:13413

Attributes
  • auth_value

    866ce0ed8cfe2be77fb43a4912677698

Targets

    • Target

      aef796d69764f3cbe50f3f3a873596cdc0a5a1734fa1d7bf36dd0d517cf9a667

    • Size

      361KB

    • MD5

      bb6e76cd2783d7a6531765dcc2162d9e

    • SHA1

      bbe9ec24ac1a4a6f3cd242aade4e2137021171be

    • SHA256

      aef796d69764f3cbe50f3f3a873596cdc0a5a1734fa1d7bf36dd0d517cf9a667

    • SHA512

      2396b34f01111acf5bbdd60150ac01d870c2714d4d83071b8088939c6ab589f06d89d700c1d2093032f7ea0510e6dac2001b41681f1d45a786d02a27da39a2df

    • SSDEEP

      6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks