General

  • Target

    cb8b41fbef8c9d620b994ec15c8215dcd24df38651a4833aa9939780013410d0

  • Size

    539KB

  • Sample

    230324-m8ezmsdh29

  • MD5

    c83182ec9e206ed0f89fca5e71e5153c

  • SHA1

    e049322681ff262272d97b48433cddc673864021

  • SHA256

    cb8b41fbef8c9d620b994ec15c8215dcd24df38651a4833aa9939780013410d0

  • SHA512

    ec0b178f74c02049e99e6bc614d716b27fc08db73dda759223078ee9c109aef51d19e14cb1c19d75cb61f80edc1471981f80edd68cc3fe33c25ced05f3c038e0

  • SSDEEP

    12288:FMrYy90+1ZLgxndTmz/5sxOBUNc1AgsxL4Dn+FceygC:xyJOoDOc1AB3FceyH

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

hero

C2

193.233.20.31:4125

Attributes
  • auth_value

    11f3c75a88ca461bcc8d6bf60a1193e3

Targets

    • Target

      cb8b41fbef8c9d620b994ec15c8215dcd24df38651a4833aa9939780013410d0

    • Size

      539KB

    • MD5

      c83182ec9e206ed0f89fca5e71e5153c

    • SHA1

      e049322681ff262272d97b48433cddc673864021

    • SHA256

      cb8b41fbef8c9d620b994ec15c8215dcd24df38651a4833aa9939780013410d0

    • SHA512

      ec0b178f74c02049e99e6bc614d716b27fc08db73dda759223078ee9c109aef51d19e14cb1c19d75cb61f80edc1471981f80edd68cc3fe33c25ced05f3c038e0

    • SSDEEP

      12288:FMrYy90+1ZLgxndTmz/5sxOBUNc1AgsxL4Dn+FceygC:xyJOoDOc1AB3FceyH

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks