General

  • Target

    0x00080000000122fe-1062.dat

  • Size

    175KB

  • Sample

    230327-2qsv4shf4z

  • MD5

    840156e820d613217f06d4bc1f6d6da1

  • SHA1

    14312f475d3f032f90acc56e9f94490b738ef4ac

  • SHA256

    90e161e85f5eba920577568c3fa8da13a22bfbad568310ba1b8d7fab210db5bc

  • SHA512

    fe4abebdd10b5cf1c5fe563e1913e39784c8f46e745ebe8033fe3209e44f23077eb35035ee3f2196994e733116e48bd2e98fc2a8ecb54db62b889bded678f49d

  • SSDEEP

    3072:jxqZWRZaPkOQ3TjmTseesFqh+XxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwh:1qZoTjalqh

Malware Config

Extracted

Family

redline

Botnet

renta

C2

176.113.115.145:4125

Attributes
  • auth_value

    359596fd5b36e9925ade4d9a1846bafb

Targets

    • Target

      0x00080000000122fe-1062.dat

    • Size

      175KB

    • MD5

      840156e820d613217f06d4bc1f6d6da1

    • SHA1

      14312f475d3f032f90acc56e9f94490b738ef4ac

    • SHA256

      90e161e85f5eba920577568c3fa8da13a22bfbad568310ba1b8d7fab210db5bc

    • SHA512

      fe4abebdd10b5cf1c5fe563e1913e39784c8f46e745ebe8033fe3209e44f23077eb35035ee3f2196994e733116e48bd2e98fc2a8ecb54db62b889bded678f49d

    • SSDEEP

      3072:jxqZWRZaPkOQ3TjmTseesFqh+XxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwh:1qZoTjalqh

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks