General

  • Target

    0x00070000000133d1-1062.dat

  • Size

    175KB

  • Sample

    230327-2zm18afg34

  • MD5

    46d578f9e69eaf0a10b78df8dfa48c84

  • SHA1

    7e5d5e101aa0f0db9985a53cb0078bb48c6c92de

  • SHA256

    85aee610e21063fcde7d14c51943b4b1f88bb6cc10f6c5b0bd290d46e5fa1753

  • SHA512

    288c29cf10051e3a895c370c95b7e4d0acd88d4d47181032b0300274368680d887f543f3d5af2d3b316b17a4fe49ee2caf9b91cf4e328b0908d9cb4b81e1af9d

  • SSDEEP

    3072:jxqZWRZaPkOQ3TjmTseesFqh+XxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwh:1qZoTjalqh

Malware Config

Extracted

Family

redline

Botnet

renta

C2

176.113.115.145:4125

Attributes
  • auth_value

    359596fd5b36e9925ade4d9a1846bafb

Targets

    • Target

      0x00070000000133d1-1062.dat

    • Size

      175KB

    • MD5

      46d578f9e69eaf0a10b78df8dfa48c84

    • SHA1

      7e5d5e101aa0f0db9985a53cb0078bb48c6c92de

    • SHA256

      85aee610e21063fcde7d14c51943b4b1f88bb6cc10f6c5b0bd290d46e5fa1753

    • SHA512

      288c29cf10051e3a895c370c95b7e4d0acd88d4d47181032b0300274368680d887f543f3d5af2d3b316b17a4fe49ee2caf9b91cf4e328b0908d9cb4b81e1af9d

    • SSDEEP

      3072:jxqZWRZaPkOQ3TjmTseesFqh+XxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwh:1qZoTjalqh

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks