General

  • Target

    0x00090000000122ec-1001.dat

  • Size

    175KB

  • Sample

    230327-2xm87sfg26

  • MD5

    5bb02e63a347f74e2963002fb5e55d1a

  • SHA1

    58dddba23d4339039638c6ab4a905951f0cdec26

  • SHA256

    2d44c3d9e28ae480b643a65f8a5968762217a8f9b08cb75d4c63ab07f37ef98d

  • SHA512

    96ca4d675e07c00e9446030235eac97b123181a610c8b13561650344f31e7c673a6107d8ba51e989ecd7143f4c19d04b671789d0a1895284d9cf7ab5b766b122

  • SSDEEP

    3072:4xqZWZRanU2n0/Z62eJ5evJ9ih+PxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOm:mqZg/Z6XJIih

Malware Config

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Targets

    • Target

      0x00090000000122ec-1001.dat

    • Size

      175KB

    • MD5

      5bb02e63a347f74e2963002fb5e55d1a

    • SHA1

      58dddba23d4339039638c6ab4a905951f0cdec26

    • SHA256

      2d44c3d9e28ae480b643a65f8a5968762217a8f9b08cb75d4c63ab07f37ef98d

    • SHA512

      96ca4d675e07c00e9446030235eac97b123181a610c8b13561650344f31e7c673a6107d8ba51e989ecd7143f4c19d04b671789d0a1895284d9cf7ab5b766b122

    • SSDEEP

      3072:4xqZWZRanU2n0/Z62eJ5evJ9ih+PxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOm:mqZg/Z6XJIih

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks