General

  • Target

    0x0008000000012318-1069.dat

  • Size

    175KB

  • Sample

    230327-2jh3bsff66

  • MD5

    17b5777fb6e36f15e9f4cb6f0f503a25

  • SHA1

    d3fa33547222188d114308998cc54e6add919bc0

  • SHA256

    6f07a9b86c3c77df4cabfa988dffc16dd6830ea9afabecf0bcbcef62021b0f47

  • SHA512

    c35259398f7a2d079be7e0aa1dc61538249417492d15a48b369b0750c55f5e91ca1d3dc2550501c330b7479c466fe285682d6631de69dcb220a72c97e12dcebc

  • SSDEEP

    3072:jxqZWRZaPkOQ3TjmTseesFqh+XxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwh:1qZoTjalqh

Malware Config

Extracted

Family

redline

Botnet

renta

C2

176.113.115.145:4125

Attributes
  • auth_value

    359596fd5b36e9925ade4d9a1846bafb

Targets

    • Target

      0x0008000000012318-1069.dat

    • Size

      175KB

    • MD5

      17b5777fb6e36f15e9f4cb6f0f503a25

    • SHA1

      d3fa33547222188d114308998cc54e6add919bc0

    • SHA256

      6f07a9b86c3c77df4cabfa988dffc16dd6830ea9afabecf0bcbcef62021b0f47

    • SHA512

      c35259398f7a2d079be7e0aa1dc61538249417492d15a48b369b0750c55f5e91ca1d3dc2550501c330b7479c466fe285682d6631de69dcb220a72c97e12dcebc

    • SSDEEP

      3072:jxqZWRZaPkOQ3TjmTseesFqh+XxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwh:1qZoTjalqh

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks