General

  • Target

    0x001a0000000124a1-1036.dat

  • Size

    175KB

  • Sample

    230326-xdkxhshe96

  • MD5

    2bf222e554ef91aa5164f6939ff97f4b

  • SHA1

    6f9ff75bc7226b6f443959f6687e0807e8f878fd

  • SHA256

    c0f85885c32b21daba984eb3702115b9fc51f521967bb26c5aa8d0c31b7bda5e

  • SHA512

    36bc5169436cfd2826c95b25fca98c61f28bb3ee7586845ea6d2337834445b3fceab43067595c10cb75aad58626fcebecce8c4841fc4f6260d0df71519049cd7

  • SSDEEP

    3072:sxqZW11a2kX8f516fTKev/FThwrxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuz:CqZk516LTTh

Malware Config

Extracted

Family

redline

Botnet

dogma

C2

193.233.20.32:4125

Attributes
  • auth_value

    1b692976ca991040f2e8890409c35142

Targets

    • Target

      0x001a0000000124a1-1036.dat

    • Size

      175KB

    • MD5

      2bf222e554ef91aa5164f6939ff97f4b

    • SHA1

      6f9ff75bc7226b6f443959f6687e0807e8f878fd

    • SHA256

      c0f85885c32b21daba984eb3702115b9fc51f521967bb26c5aa8d0c31b7bda5e

    • SHA512

      36bc5169436cfd2826c95b25fca98c61f28bb3ee7586845ea6d2337834445b3fceab43067595c10cb75aad58626fcebecce8c4841fc4f6260d0df71519049cd7

    • SSDEEP

      3072:sxqZW11a2kX8f516fTKev/FThwrxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuz:CqZk516LTTh

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks