General

  • Target

    0x000600000002313b-1139.dat

  • Size

    175KB

  • Sample

    230330-p8nynaeb8x

  • MD5

    0fa34cd3a2518cda73fa6d663e243940

  • SHA1

    214e990a8f5c5c414f535c62eea9e4b6d9b1c9fc

  • SHA256

    7326cf17df05493ff88979c06b23e7729fde2cd4d55a093eb428c0a580d260e6

  • SHA512

    67bd14fdbde4385836752dab89e457527ae24b4d9c552a5c8a8175e1853eb398bb4db6ec0001d4d70d05e0b7b2b82a69853486be802b1106b80e2cd73b108991

  • SSDEEP

    3072:DxqZWFFa7E6T8T5nkW0whesC9ih4fxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jz:VqZcT5n/Hgih

Malware Config

Extracted

Family

redline

Botnet

lino

C2

176.113.115.145:4125

Attributes
  • auth_value

    ac19251c9237676a0dd7d46d3f536e96

Targets

    • Target

      0x000600000002313b-1139.dat

    • Size

      175KB

    • MD5

      0fa34cd3a2518cda73fa6d663e243940

    • SHA1

      214e990a8f5c5c414f535c62eea9e4b6d9b1c9fc

    • SHA256

      7326cf17df05493ff88979c06b23e7729fde2cd4d55a093eb428c0a580d260e6

    • SHA512

      67bd14fdbde4385836752dab89e457527ae24b4d9c552a5c8a8175e1853eb398bb4db6ec0001d4d70d05e0b7b2b82a69853486be802b1106b80e2cd73b108991

    • SSDEEP

      3072:DxqZWFFa7E6T8T5nkW0whesC9ih4fxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jz:VqZcT5n/Hgih

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks