General

  • Target

    465325a3ebd9890234c2829cbb4cf3ca29f7591eb64b5bb21a1e4834410bd0b2.zip

  • Size

    51KB

  • Sample

    230329-skk4msad5y

  • MD5

    7df5301381135a1bd18528a423f45084

  • SHA1

    fc91fbf486d1c6ddce73c408376631ec2513d319

  • SHA256

    f8dae4a90a7356e1dee7af8f46b7438884a5b30fd27b8026427a3ad3caaf8162

  • SHA512

    065d078e040786b12cdfd2e25fd1fe5f52d613f97f330a8d9a6a9a3a322ca1178f614dff6fbbecf9d5f693dbef612c76b05a03d08c2c6d35d038774e93b947ff

  • SSDEEP

    1536:4ouPTlWk9khAqTlF+wBqIKnRF/crbTIxk:43PJWkq5JF+wIL0rbGk

Malware Config

Extracted

Family

redline

Botnet

nado

C2

176.113.115.145:4125

Attributes
  • auth_value

    a648e365d8e0df895a84152ad68ffc56

Targets

    • Target

      465325a3ebd9890234c2829cbb4cf3ca29f7591eb64b5bb21a1e4834410bd0b2

    • Size

      175KB

    • MD5

      2d5cceb9fc4dc32afd509390d93842ec

    • SHA1

      c622d7bbd6ca971d1ab1fc1ae1e89314cc19b7db

    • SHA256

      465325a3ebd9890234c2829cbb4cf3ca29f7591eb64b5bb21a1e4834410bd0b2

    • SHA512

      bf851cdff5fad758542a46cf61d1315cc53178db44588b435b0208d2b5a01851abb3a6b0b309bafb82d04e9b234334df6fa95da0df1c209618d2a4ad1fddd360

    • SSDEEP

      3072:yxqZWFFa7E6T825De559yhGfxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw+cO:gqZcMUyh

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks