General

  • Target

    0x000600000001af07-2338.dat

  • Size

    168KB

  • Sample

    230414-p45evahh39

  • MD5

    1eed54a048b387471d40ab1094221ef1

  • SHA1

    5004d555d2e74a72b07a7fe1e512cb8f8ee5ba98

  • SHA256

    c97ba12c976ee628111a13331099e868c64bff78b392fe156662235ce9c4dc19

  • SHA512

    e781886c99944ef136036514f5773eb3566cb0b4f331bd013492ee2cd36fbb6decc1a88d25f21a86ad9205dbac5c53cacd145c9b10b638e3ac04742795c43c13

  • SSDEEP

    3072:VzDdAubgUE4j/HqVkKcO9XnpSN/8e8hB:VzDOu0UPfw9XnpSN/

Malware Config

Extracted

Family

redline

Botnet

soft

C2

77.91.124.146:4121

Attributes
  • auth_value

    e65663e455bca3c5699650b66e76ceaa

Targets

    • Target

      0x000600000001af07-2338.dat

    • Size

      168KB

    • MD5

      1eed54a048b387471d40ab1094221ef1

    • SHA1

      5004d555d2e74a72b07a7fe1e512cb8f8ee5ba98

    • SHA256

      c97ba12c976ee628111a13331099e868c64bff78b392fe156662235ce9c4dc19

    • SHA512

      e781886c99944ef136036514f5773eb3566cb0b4f331bd013492ee2cd36fbb6decc1a88d25f21a86ad9205dbac5c53cacd145c9b10b638e3ac04742795c43c13

    • SSDEEP

      3072:VzDdAubgUE4j/HqVkKcO9XnpSN/8e8hB:VzDOu0UPfw9XnpSN/

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks