Resubmissions

14/10/2022, 12:39

221014-pvvt2sddh6 10

14/10/2022, 09:06

221014-k2q28agfe6 10

General

  • Target

    14c258321f193dd26c85bc9e9675d132.exe

  • Size

    280KB

  • Sample

    221014-pvvt2sddh6

  • MD5

    14c258321f193dd26c85bc9e9675d132

  • SHA1

    821b90506da90636150af210ba77ca236a85cc79

  • SHA256

    6139beebf508e06eb519c2350317c832f5c1cc4e3572dd0b6a9db79a38133029

  • SHA512

    92e11efb248ce9586d9934e1b468430581c5ffc9838c8f94f22ac2590ee28db5edb9119b7246f5ffed44e306f78ccf2a6c121defe74501d8129a5c1e56418794

  • SSDEEP

    3072:9WZ+m0RJjQgcEuJKGCXFAKuBzQ94UZ6EMmt:9WZ+7jCZ

Malware Config

Extracted

Family

redline

Botnet

word

C2

67.43.239.150:31615

Attributes
  • auth_value

    ed7906b28933e162ea6213ede0ffc668

Targets

    • Target

      14c258321f193dd26c85bc9e9675d132.exe

    • Size

      280KB

    • MD5

      14c258321f193dd26c85bc9e9675d132

    • SHA1

      821b90506da90636150af210ba77ca236a85cc79

    • SHA256

      6139beebf508e06eb519c2350317c832f5c1cc4e3572dd0b6a9db79a38133029

    • SHA512

      92e11efb248ce9586d9934e1b468430581c5ffc9838c8f94f22ac2590ee28db5edb9119b7246f5ffed44e306f78ccf2a6c121defe74501d8129a5c1e56418794

    • SSDEEP

      3072:9WZ+m0RJjQgcEuJKGCXFAKuBzQ94UZ6EMmt:9WZ+7jCZ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks