General

  • Target

    0x000900000001af27-199.dat

  • Size

    176KB

  • Sample

    230306-t42feadc97

  • MD5

    f528a645683dc5c95b584545b53a921a

  • SHA1

    0d896fa5b92d30dfb27c83579711c0e8423f5d65

  • SHA256

    e7733bb8b8fdcb5cccbfcf411c162c10e0871a30e69c35fbf572ecceab410be7

  • SHA512

    c9a016771d86c44b20a0b3443b0f5c8f3367b43e565022768bc5ebae56e14f78a48bc3e8a189b6ac466542d8979231a0e7999378d85e2b04e5d16c5374ffd03c

  • SSDEEP

    3072:BxqZW11a2kX8fkRyeiBWep3FhhFvxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOf:zqZkkgN1hh

Malware Config

Extracted

Family

redline

Botnet

fabio

C2

193.233.20.27:4123

Attributes
  • auth_value

    56b82736c3f56b13be8e64c87d2cf9e5

Targets

    • Target

      0x000900000001af27-199.dat

    • Size

      176KB

    • MD5

      f528a645683dc5c95b584545b53a921a

    • SHA1

      0d896fa5b92d30dfb27c83579711c0e8423f5d65

    • SHA256

      e7733bb8b8fdcb5cccbfcf411c162c10e0871a30e69c35fbf572ecceab410be7

    • SHA512

      c9a016771d86c44b20a0b3443b0f5c8f3367b43e565022768bc5ebae56e14f78a48bc3e8a189b6ac466542d8979231a0e7999378d85e2b04e5d16c5374ffd03c

    • SSDEEP

      3072:BxqZW11a2kX8fkRyeiBWep3FhhFvxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOf:zqZkkgN1hh

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.