General

  • Target

    e8e6aa53b205d16bb3c0dacfa596b3a2fcbe91cafcabbc77d46cb311c42e7dcb

  • Size

    431KB

  • Sample

    230402-dy42caed48

  • MD5

    27601da6961aa477c9e5f8400794938c

  • SHA1

    ab7a7a7af7bc8dd735b4036105a0df4f69ccbc83

  • SHA256

    e8e6aa53b205d16bb3c0dacfa596b3a2fcbe91cafcabbc77d46cb311c42e7dcb

  • SHA512

    777aa7208d19fedc050597e1abc1bbdcae211ac1a6cbcdff8af2a875349be7137ee6c060bf9842988d217b0fd3c5734af51a31a8d3fe9a6d679fa11499745e39

  • SSDEEP

    6144:+oKOZMadQ+rq0l++T+rtkG8PRpoTHGmQ7lefGkbQvEu:+FOZMaOcvD+rqRPRmTHGfxXcu

Malware Config

Extracted

Family

redline

Botnet

@Germany

C2

185.11.61.125:22344

Attributes
  • auth_value

    9d15d78194367a949e54a07d6ce02c62

Targets

    • Target

      e8e6aa53b205d16bb3c0dacfa596b3a2fcbe91cafcabbc77d46cb311c42e7dcb

    • Size

      431KB

    • MD5

      27601da6961aa477c9e5f8400794938c

    • SHA1

      ab7a7a7af7bc8dd735b4036105a0df4f69ccbc83

    • SHA256

      e8e6aa53b205d16bb3c0dacfa596b3a2fcbe91cafcabbc77d46cb311c42e7dcb

    • SHA512

      777aa7208d19fedc050597e1abc1bbdcae211ac1a6cbcdff8af2a875349be7137ee6c060bf9842988d217b0fd3c5734af51a31a8d3fe9a6d679fa11499745e39

    • SSDEEP

      6144:+oKOZMadQ+rq0l++T+rtkG8PRpoTHGmQ7lefGkbQvEu:+FOZMaOcvD+rqRPRmTHGfxXcu

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks