General

  • Target

    file.exe

  • Size

    441KB

  • Sample

    221102-natwksbdb3

  • MD5

    9f97bce4f2df6f6986df014bba0e7792

  • SHA1

    c7520ce37b090243e64eab501865e8edc4206ea0

  • SHA256

    1d23a044889676bab59b51cdbdb61c78aaec1838c8209398b9672f0c7bd5b4a9

  • SHA512

    5cbc4287cd3a7bdb6d934c5ddaf3b194954d6cf6ae24135a8408c4fec6835a8b0ad3aa8d306adbdb72f9b585367f9669a27ad220139445fada4d610dd85fa74e

  • SSDEEP

    6144:r8riwHwZvq6hPPMpmAtbq2m/cSQMQqVVm/EJWFAKyhXbC7ITsq:r8VHwZhipD7m//seVm/EJWiKyhXG7

Malware Config

Extracted

Family

redline

Botnet

mix

C2

193.106.191.25:47242

Attributes
  • auth_value

    5469d87831a100553f2f10d3aadec8bb

Targets

    • Target

      file.exe

    • Size

      441KB

    • MD5

      9f97bce4f2df6f6986df014bba0e7792

    • SHA1

      c7520ce37b090243e64eab501865e8edc4206ea0

    • SHA256

      1d23a044889676bab59b51cdbdb61c78aaec1838c8209398b9672f0c7bd5b4a9

    • SHA512

      5cbc4287cd3a7bdb6d934c5ddaf3b194954d6cf6ae24135a8408c4fec6835a8b0ad3aa8d306adbdb72f9b585367f9669a27ad220139445fada4d610dd85fa74e

    • SSDEEP

      6144:r8riwHwZvq6hPPMpmAtbq2m/cSQMQqVVm/EJWFAKyhXbC7ITsq:r8VHwZhipD7m//seVm/EJWiKyhXG7

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks