General

  • Target

    file.exe

  • Size

    405KB

  • Sample

    221105-tt757sgfb5

  • MD5

    e1f91551d2d3a2756b84657e54586729

  • SHA1

    8d7aab49ab6bbe446173b1c5ff71ba1c95c634f0

  • SHA256

    7012132a463dd9ddd6d744e376f034fe8808eea2cfa3e7436e180176258090cd

  • SHA512

    a00d4605c1320963085c99282906ffb9a1e24c0e0c7fb2b27002e9f222862ead102476620d46fab74e81ee34e1fa7f289d9810ee32e6ec70f1499586176af4e7

  • SSDEEP

    6144:QjqfHMZvAcPkBFeuVvIXPA6wS+x6HSZHeCIajoJ8xFYyj0n6qhY:QjqPM5AcBuRCPVceDCa8PYyjk6

Malware Config

Extracted

Family

redline

Botnet

suk

C2

193.106.191.25:47242

Attributes
  • auth_value

    9762d5bcad64c7855837e80c232c7e77

Targets

    • Target

      file.exe

    • Size

      405KB

    • MD5

      e1f91551d2d3a2756b84657e54586729

    • SHA1

      8d7aab49ab6bbe446173b1c5ff71ba1c95c634f0

    • SHA256

      7012132a463dd9ddd6d744e376f034fe8808eea2cfa3e7436e180176258090cd

    • SHA512

      a00d4605c1320963085c99282906ffb9a1e24c0e0c7fb2b27002e9f222862ead102476620d46fab74e81ee34e1fa7f289d9810ee32e6ec70f1499586176af4e7

    • SSDEEP

      6144:QjqfHMZvAcPkBFeuVvIXPA6wS+x6HSZHeCIajoJ8xFYyj0n6qhY:QjqPM5AcBuRCPVceDCa8PYyjk6

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks