General

  • Target

    ADOBE.PHOTOSHOP.crack.rar

  • Size

    577KB

  • Sample

    230131-ay5fbsdc96

  • MD5

    cc9e6cc2006d2702099bf1f53c74c077

  • SHA1

    331fdceff85a337ed3b1f3a48a514264d98e1f7b

  • SHA256

    c056eaeac0a861dcefda16c0b465e22232991c370334b0ae9e4d84846b0df583

  • SHA512

    551ad3cd8a5ed5ac79cda8baac9d57f15bc75f3e8575ef9e7478367eacdc5828a0737a46f5401e6f1b6aa4526ae6b873f1dac61b4ad47c75fbc0e49daf0710a9

  • SSDEEP

    12288:z5VgNIOR1WVJnwrNODFv71/8laM8PREtvg24FgkepsahIvuTDqABgNWH8WkN:IIfkMhZEp8+AinEujBgNLRN

Malware Config

Extracted

Family

redline

Botnet

@exmonex_sup

C2

82.115.223.46:57672

Attributes
  • auth_value

    d2ed80c207656c5a40c25ee8eda0893f

Targets

    • Target

      ADOBE PHOTOSHOP crack/Installer.exe

    • Size

      724.8MB

    • MD5

      fbb03da50fd4fb2f6679ff4d5be94565

    • SHA1

      ffc4b3f49c85cbfc2fabc03b1856ca1f61b41b25

    • SHA256

      5aa7042fa4151c7c41e497d1c0e793403a4dbbe848d599e07218142589f4be5a

    • SHA512

      4aa1cc7769f132ff8e2ad956a0b31fabb01bd9d23e0ec9dda15f8c5fa50c531cf49c55b25d3f2f2e22b42ffafac4b1f62dba28040736590f5ff2e0dcd912b280

    • SSDEEP

      12288:TQtksWH0v877rpR9HhPv+k8gckWkCSDQ0uWeh3ih9HlA:EqsaF7VRhhPv84DQ0uBYTu

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks