General

  • Target

    tmp

  • Size

    175KB

  • Sample

    230205-18hbnabb29

  • MD5

    dbf6954a47c2b4ee5f2b9abe34c49ae8

  • SHA1

    5f8a8e434274fe41de96e7ec91c3aac83243497c

  • SHA256

    1adabdcafef5e2c6792df2390ce22151c46f03203bf529a708d776809710b83f

  • SHA512

    8f67526c9b5d1daf7a581c3816ca6797ae76855a33890a605ca34c3c45de7c826868d2968000b4139ee50176cc86d315a94fb982efa5006e6fb40656cfff77aa

  • SSDEEP

    3072:MxqZWFtaKUPLvYjdIaZvFGnem5AdhtbxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUwy:iqZLYxIycsdh

Malware Config

Extracted

Family

redline

Botnet

temposse5555555555

C2

82.115.223.9:15486

Attributes
  • auth_value

    029e96f0c0135a379f06ce0d3ae33ef6

Targets

    • Target

      tmp

    • Size

      175KB

    • MD5

      dbf6954a47c2b4ee5f2b9abe34c49ae8

    • SHA1

      5f8a8e434274fe41de96e7ec91c3aac83243497c

    • SHA256

      1adabdcafef5e2c6792df2390ce22151c46f03203bf529a708d776809710b83f

    • SHA512

      8f67526c9b5d1daf7a581c3816ca6797ae76855a33890a605ca34c3c45de7c826868d2968000b4139ee50176cc86d315a94fb982efa5006e6fb40656cfff77aa

    • SSDEEP

      3072:MxqZWFtaKUPLvYjdIaZvFGnem5AdhtbxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUwy:iqZLYxIycsdh

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks