General

  • Target

    7e35de071bdb96517e6aa5eeb50e037f0f44ffb2dd3fc3971ac68bd2f211a7d2

  • Size

    175KB

  • Sample

    221206-z5k3psea47

  • MD5

    1bd8bdf9b43e506fd12e79de2fb2dc6f

  • SHA1

    7d1af5f2fb51cfe460615a0a37b8d6b187db0e19

  • SHA256

    7e35de071bdb96517e6aa5eeb50e037f0f44ffb2dd3fc3971ac68bd2f211a7d2

  • SHA512

    ba7df2ec2ed36e5216c0501c216a09e4844051054bc489099ae63647a0a802410243c60e56a83f5710dc6ff5636de34a0bea4f6f40bceb880d008940c6895571

  • SSDEEP

    3072:1xqZW3Daa5U5sg9tbyOUPGeP59Sh13xNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw04:/qZRyOK1Sh

Malware Config

Extracted

Family

redline

Botnet

Newwww2023

C2

185.106.92.214:2515

Attributes
  • auth_value

    0e2250f24c7a34075db77aa6f56e856f

Targets

    • Target

      7e35de071bdb96517e6aa5eeb50e037f0f44ffb2dd3fc3971ac68bd2f211a7d2

    • Size

      175KB

    • MD5

      1bd8bdf9b43e506fd12e79de2fb2dc6f

    • SHA1

      7d1af5f2fb51cfe460615a0a37b8d6b187db0e19

    • SHA256

      7e35de071bdb96517e6aa5eeb50e037f0f44ffb2dd3fc3971ac68bd2f211a7d2

    • SHA512

      ba7df2ec2ed36e5216c0501c216a09e4844051054bc489099ae63647a0a802410243c60e56a83f5710dc6ff5636de34a0bea4f6f40bceb880d008940c6895571

    • SSDEEP

      3072:1xqZW3Daa5U5sg9tbyOUPGeP59Sh13xNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw04:/qZRyOK1Sh

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks