General

  • Target

    856fc10fc4ffc2d24670e1d06998b7647c7739df7421285a53f46f227a1b2d93

  • Size

    685KB

  • Sample

    230327-rllwwsdg76

  • MD5

    18fa5994fe0a4e1b5ecadf4339035bcd

  • SHA1

    30092438ffb30146d244f6ad8d95c9e1319664f8

  • SHA256

    856fc10fc4ffc2d24670e1d06998b7647c7739df7421285a53f46f227a1b2d93

  • SHA512

    4e666583b32c3a310a4efe02ba882cb3e9f638ee6452b572ba2e71154ad737132b5d3fe37b6ad1d9dfeb62976e352ab2f07bdf4866be9887327ec2f7b337bd95

  • SSDEEP

    12288:/Mrwy90T/w5bEl1X5RJSkPKyz0GmfqwwvvwUBKYiEnVBZ8UN:DyM/JVRrKy7mfqLXYYiEvZBN

Malware Config

Extracted

Family

redline

Botnet

sony

C2

193.233.20.33:4125

Attributes
  • auth_value

    1d93d1744381eeb4fcfd7c23ffe0f0b4

Extracted

Family

redline

Botnet

nice

C2

193.233.20.33:4125

Attributes
  • auth_value

    a7371b75699e8bc7c51fb960e8ac9e81

Targets

    • Target

      856fc10fc4ffc2d24670e1d06998b7647c7739df7421285a53f46f227a1b2d93

    • Size

      685KB

    • MD5

      18fa5994fe0a4e1b5ecadf4339035bcd

    • SHA1

      30092438ffb30146d244f6ad8d95c9e1319664f8

    • SHA256

      856fc10fc4ffc2d24670e1d06998b7647c7739df7421285a53f46f227a1b2d93

    • SHA512

      4e666583b32c3a310a4efe02ba882cb3e9f638ee6452b572ba2e71154ad737132b5d3fe37b6ad1d9dfeb62976e352ab2f07bdf4866be9887327ec2f7b337bd95

    • SSDEEP

      12288:/Mrwy90T/w5bEl1X5RJSkPKyz0GmfqwwvvwUBKYiEnVBZ8UN:DyM/JVRrKy7mfqLXYYiEvZBN

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.