General

  • Target

    file.exe

  • Size

    350KB

  • Sample

    221103-t78znaehbj

  • MD5

    ff6c48bb6365860d0b286f5c3c2dfa98

  • SHA1

    eb469f89fc01114cd8f61063a1d430051c5b7f2b

  • SHA256

    b9467435e46a884005982db9894d3a04d88f170b18769ecba1a7145748016d6f

  • SHA512

    8025fb690be303edc820d7e4b20113ae1475dae603c55ec9f006dd8850009ddf470294d48a86f282d20ff3900cffb92408105f468a8eec7342eb5a649d86c7d1

  • SSDEEP

    6144:RADnt8y/LEysCriXuwwdXomRIE50wAbJyTF+vMV4EBxjGyrP:RAbK4oysCQMYmRISx8ATmE7T

Malware Config

Extracted

Family

redline

Botnet

mix

C2

193.106.191.25:47242

Attributes
  • auth_value

    5469d87831a100553f2f10d3aadec8bb

Targets

    • Target

      file.exe

    • Size

      350KB

    • MD5

      ff6c48bb6365860d0b286f5c3c2dfa98

    • SHA1

      eb469f89fc01114cd8f61063a1d430051c5b7f2b

    • SHA256

      b9467435e46a884005982db9894d3a04d88f170b18769ecba1a7145748016d6f

    • SHA512

      8025fb690be303edc820d7e4b20113ae1475dae603c55ec9f006dd8850009ddf470294d48a86f282d20ff3900cffb92408105f468a8eec7342eb5a649d86c7d1

    • SSDEEP

      6144:RADnt8y/LEysCriXuwwdXomRIE50wAbJyTF+vMV4EBxjGyrP:RAbK4oysCQMYmRISx8ATmE7T

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks