General

  • Target

    file

  • Size

    405KB

  • Sample

    221106-v4l66afehl

  • MD5

    d00fd596ea300cabaeb20ab7b0daf702

  • SHA1

    684753dfcc52d773394d1f6ed1f15ef7d10b407a

  • SHA256

    f18f923e42727314fc903f2016f68a1d1872984fc477609fc8cef85b5b13c793

  • SHA512

    8b7da31f2bd0642aca7ecb9946792bdf93b5cf60f91685642e8c9b6d0dd5f2ef1ee79dbe7b05c5d8103ce734a650b91d4086ac8c25233e53f0139f2da0e7e37c

  • SSDEEP

    6144:vcQwnA/H029qrCGW77rjijBgWY1fCpU08gzk:InA/0uoo7r+jBY2

Malware Config

Extracted

Family

redline

Botnet

suk

C2

193.106.191.25:47242

Attributes
  • auth_value

    9762d5bcad64c7855837e80c232c7e77

Targets

    • Target

      file

    • Size

      405KB

    • MD5

      d00fd596ea300cabaeb20ab7b0daf702

    • SHA1

      684753dfcc52d773394d1f6ed1f15ef7d10b407a

    • SHA256

      f18f923e42727314fc903f2016f68a1d1872984fc477609fc8cef85b5b13c793

    • SHA512

      8b7da31f2bd0642aca7ecb9946792bdf93b5cf60f91685642e8c9b6d0dd5f2ef1ee79dbe7b05c5d8103ce734a650b91d4086ac8c25233e53f0139f2da0e7e37c

    • SSDEEP

      6144:vcQwnA/H029qrCGW77rjijBgWY1fCpU08gzk:InA/0uoo7r+jBY2

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks