General

  • Target

    948129d5ff935cfa03bd67abb4348e77df76b17e414fd94a5ca242806e88386c

  • Size

    339KB

  • Sample

    230203-eeh57sae92

  • MD5

    0972fbc25f09d329dd4fe0b51d0331a6

  • SHA1

    7301608272eb5f0bc23ce0743055ad5978e55255

  • SHA256

    948129d5ff935cfa03bd67abb4348e77df76b17e414fd94a5ca242806e88386c

  • SHA512

    883e8f175a0acb33ed44e01f0fb21955397e79513dbe4ec3fa5410ec1f242b2a91acce8f4fa533409bf3a7d19b0265ec6197a34f9d3d2be5fe59451761e6b32e

  • SSDEEP

    6144:nbDQmioYCCAYp5fRZOVANlZ1iJ5ZccG7uMR9NX23BoIgPEDZCO4lw1JedPlC:nbDQ7LpDcVAN1lDm3BoIgPEDZCO4lw1H

Malware Config

Extracted

Family

redline

Botnet

24.01

C2

37.220.86.164:29170

Attributes
  • auth_value

    1c7f0aa21138601b5201a3a4a0123991

Targets

    • Target

      948129d5ff935cfa03bd67abb4348e77df76b17e414fd94a5ca242806e88386c

    • Size

      339KB

    • MD5

      0972fbc25f09d329dd4fe0b51d0331a6

    • SHA1

      7301608272eb5f0bc23ce0743055ad5978e55255

    • SHA256

      948129d5ff935cfa03bd67abb4348e77df76b17e414fd94a5ca242806e88386c

    • SHA512

      883e8f175a0acb33ed44e01f0fb21955397e79513dbe4ec3fa5410ec1f242b2a91acce8f4fa533409bf3a7d19b0265ec6197a34f9d3d2be5fe59451761e6b32e

    • SSDEEP

      6144:nbDQmioYCCAYp5fRZOVANlZ1iJ5ZccG7uMR9NX23BoIgPEDZCO4lw1JedPlC:nbDQ7LpDcVAN1lDm3BoIgPEDZCO4lw1H

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks