General

  • Target

    22e32b5fed258d9aea92db9b9ad7420e.exe

  • Size

    335KB

  • Sample

    221217-phra4agf49

  • MD5

    22e32b5fed258d9aea92db9b9ad7420e

  • SHA1

    5d42fb556374fa613d468601745396e7acfae894

  • SHA256

    8b4777d537e13d17fb97cfe32f4bc99f345b0f5b45049721ea9fba39afe341a5

  • SHA512

    a6d84a89322aa1adcfed02579f55c5c465eec3ccd882f18ff5c59bcd6cb55551be6336baadc3b96a177a9778e43911910266017ad957cb96804a55e96f1ad766

  • SSDEEP

    6144:speKo5u33bQHMRNu6VbbZyde/K7/5pc4XTSuXthKolD1jyO:gnJuVXTSuXthKolD1jyO

Malware Config

Extracted

Family

redline

Botnet

Upadated.9

C2

185.106.92.214:27015

Attributes
  • auth_value

    e7ac347a50f9f7f82af39fd2c0fac687

Targets

    • Target

      22e32b5fed258d9aea92db9b9ad7420e.exe

    • Size

      335KB

    • MD5

      22e32b5fed258d9aea92db9b9ad7420e

    • SHA1

      5d42fb556374fa613d468601745396e7acfae894

    • SHA256

      8b4777d537e13d17fb97cfe32f4bc99f345b0f5b45049721ea9fba39afe341a5

    • SHA512

      a6d84a89322aa1adcfed02579f55c5c465eec3ccd882f18ff5c59bcd6cb55551be6336baadc3b96a177a9778e43911910266017ad957cb96804a55e96f1ad766

    • SSDEEP

      6144:speKo5u33bQHMRNu6VbbZyde/K7/5pc4XTSuXthKolD1jyO:gnJuVXTSuXthKolD1jyO

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks