General

  • Target

    cb948763ae6a3a61e0965436f12ad4770636f2308874298b84630a19b76f6132.zip

  • Size

    51KB

  • Sample

    230328-nn8lwscd4w

  • MD5

    3a1a6e71189e27489a6dc85f84fb3f52

  • SHA1

    e125a6a50f3a557daf61b15e8285fc5bd260bcef

  • SHA256

    d3df779364b44ab9e982f9b14e4f120f2747957a205720050ea472307142823e

  • SHA512

    72dd80295c80e564e02c793db22964dc8d8866f379961a13ab119e85e14bfeb18c3fa190d69f92534940679b4ab330befd726b2f10082ceb60d1aa75dab5bd97

  • SSDEEP

    768:NtG/l++VpIvJGxNH+Uh4/GJWmgUNx7he1s8CN6xorL20A6pf1EdtWTdjDN9:NM/o+yUU/ez7sNxCyLkeAxDN9

Malware Config

Extracted

Family

redline

Botnet

dent

C2

193.233.20.33:4125

Attributes
  • auth_value

    e795368557f02e28e8aef6bcb279a3b0

Targets

    • Target

      cb948763ae6a3a61e0965436f12ad4770636f2308874298b84630a19b76f6132

    • Size

      175KB

    • MD5

      cda3fc6afbb35175030809bfc7efbc66

    • SHA1

      ee7e577feb8eb383ad7fc41013a018775ea954d9

    • SHA256

      cb948763ae6a3a61e0965436f12ad4770636f2308874298b84630a19b76f6132

    • SHA512

      cd4dd0f9d31ab2753844e72f24979936e3e7fe840b100b2f9652f6019369e3b0072f4ee613235e8a7f522597752016855651ec23c4745d556543dcd47d617de6

    • SSDEEP

      3072:s9xqZWBJaHEDgXp5lCe159Eh4bxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwY:sHqZV7ljEh

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks