General

  • Target

    0x00090000000122fe-2024.dat

  • Size

    175KB

  • Sample

    230302-nqplsscg26

  • MD5

    481339172c49cebabafce64b4467d26f

  • SHA1

    4817d8d462844f9b04dafc87fc2ea100d61986fc

  • SHA256

    22e595626c9f9510831405080ca922f6fa1d002640726868a816e905bd2cfb7c

  • SHA512

    60d222c3ef5e6d6c934406a773c6992214572e67b51b57c00ba41ee1370fa7ee08140536c4cb62a5dcbeb1ef7166caf5087c88cfb7aa4db2a5ac7966254ec349

  • SSDEEP

    3072:KxqZWJBaKULo3pfEWGljeerDF/hevTxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw09:4qZIpfEWYL/hk

Malware Config

Extracted

Family

redline

Botnet

fuba

C2

193.56.146.11:4162

Attributes
  • auth_value

    43015841fc23c63b15ca6ffe1d278d5e

Targets

    • Target

      0x00090000000122fe-2024.dat

    • Size

      175KB

    • MD5

      481339172c49cebabafce64b4467d26f

    • SHA1

      4817d8d462844f9b04dafc87fc2ea100d61986fc

    • SHA256

      22e595626c9f9510831405080ca922f6fa1d002640726868a816e905bd2cfb7c

    • SHA512

      60d222c3ef5e6d6c934406a773c6992214572e67b51b57c00ba41ee1370fa7ee08140536c4cb62a5dcbeb1ef7166caf5087c88cfb7aa4db2a5ac7966254ec349

    • SSDEEP

      3072:KxqZWJBaKULo3pfEWGljeerDF/hevTxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw09:4qZIpfEWYL/hk

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks