General

  • Target

    341492175e884c78b9752979a3b06a61442df61f8ac5c795bf5b890d294917bd.zip

  • Size

    51KB

  • Sample

    230328-nzm5bsag67

  • MD5

    2cc3e6004571155284fe0b7b0854149f

  • SHA1

    c3594e5397ddac58f7cb3a07de90c98db4cf3068

  • SHA256

    e17f776c9f598f20f4c10b8da10aaa63ef2ff83309d8a9de598e178b2f2b700a

  • SHA512

    2eba311eebe2b3929a9f11e213057614359acf1b1cda9e071a8f32296ac0dfe0ae652ef3167bf60faafad1e0eaf17d8a498d8e5918f540d695020366624ec9d4

  • SSDEEP

    768:dtG/l++VpIvJGxNH+Uh4/GJWmgUNx7he1s8CN6xorL20A6pf1EdtWTdjDNG:dM/o+yUU/ez7sNxCyLkeAxDNG

Malware Config

Extracted

Family

redline

Botnet

dent

C2

193.233.20.33:4125

Attributes
  • auth_value

    e795368557f02e28e8aef6bcb279a3b0

Targets

    • Target

      341492175e884c78b9752979a3b06a61442df61f8ac5c795bf5b890d294917bd

    • Size

      175KB

    • MD5

      af45d795e539bc03a9b9a809c53aae80

    • SHA1

      cbbc7288cc760f890718f71b757e4c4991e7d40e

    • SHA256

      341492175e884c78b9752979a3b06a61442df61f8ac5c795bf5b890d294917bd

    • SHA512

      7effc821c7751c2fc6f608a73883c34bf0a23dc9a254a116d0191c4ee39b65876e57f63e534cc182af4eaa7861d0e607771e3ca50b10985f119d247942122436

    • SSDEEP

      3072:s9xqZWBJaHEDgXp5lCe159Eh4bxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwY:sHqZV7ljEh

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks