General

  • Target

    file.exe

  • Size

    928KB

  • Sample

    230216-lkxn4sgh73

  • MD5

    e40daa27438ed7646a28c2ca77e9aefb

  • SHA1

    23c8951246bc03974234fc4262133ed5e3988b63

  • SHA256

    e79759812a2a4e54bc5ecb5e4d44f4ce29ffa178c72d6a3a1257c669edfdc5ef

  • SHA512

    8fd3b6f1be9a7d909335d9b7f625832b23da811cfca6bdca8cf752257c8a25404a4a67f4ea5330b5e7c1c200a9426740ec1978e6930f0c90f7cc4c9ab5dea231

  • SSDEEP

    24576:hy4bMvOUlNNs5s8QVolXtmxOxPgGGyZc6:U4KOUlOQV2C6PcyG

Malware Config

Extracted

Family

redline

Botnet

dubka

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5a9421183a033f283b2f23139b471f0

Extracted

Family

redline

Botnet

ruma

C2

193.233.20.13:4136

Attributes
  • auth_value

    647d00dfaba082a4a30f383bca5d1a2a

Extracted

Family

amadey

Version

3.66

C2

193.233.20.2/Bn89hku/index.php

Extracted

Family

redline

Botnet

ck

C2

176.113.115.17:4132

Attributes
  • auth_value

    7ac4424f89748eae7f5c6a4756d89c28

Targets

    • Target

      file.exe

    • Size

      928KB

    • MD5

      e40daa27438ed7646a28c2ca77e9aefb

    • SHA1

      23c8951246bc03974234fc4262133ed5e3988b63

    • SHA256

      e79759812a2a4e54bc5ecb5e4d44f4ce29ffa178c72d6a3a1257c669edfdc5ef

    • SHA512

      8fd3b6f1be9a7d909335d9b7f625832b23da811cfca6bdca8cf752257c8a25404a4a67f4ea5330b5e7c1c200a9426740ec1978e6930f0c90f7cc4c9ab5dea231

    • SSDEEP

      24576:hy4bMvOUlNNs5s8QVolXtmxOxPgGGyZc6:U4KOUlOQV2C6PcyG

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks