General

  • Target

    0x0008000000013347-68.dat

  • Size

    170KB

  • Sample

    230503-vzyz6ahe5v

  • MD5

    811a39411f3e51bc1d4c88ef4a45c605

  • SHA1

    d8e4d044d3eba56831191807797058ae034c956a

  • SHA256

    52905ea3524de76754b3082e250ef7badcf878b8fba258539c8b2d427c3808d3

  • SHA512

    31a263acfb3e1431ce40ba8d784d2dcbdb34b0eba9725a78c5816434ec8472164b3e6ad2c9ea9747056db1d1567a0ec0dc6975ede5264f7962dea3ecc94dd36a

  • SSDEEP

    1536:TyqlwNqlVZRGWY8HrIGtRSotDaZIPeKNDETGqVqbuFz1CSwx83wYk/8e8hR:Th6D3GtzD263qVeUESwx58e8hR

Malware Config

Extracted

Family

redline

Botnet

diza

C2

217.196.96.56:4138

Attributes
  • auth_value

    bbab0d2f0ae4d4fdd6b17077d93b3e80

Targets

    • Target

      0x0008000000013347-68.dat

    • Size

      170KB

    • MD5

      811a39411f3e51bc1d4c88ef4a45c605

    • SHA1

      d8e4d044d3eba56831191807797058ae034c956a

    • SHA256

      52905ea3524de76754b3082e250ef7badcf878b8fba258539c8b2d427c3808d3

    • SHA512

      31a263acfb3e1431ce40ba8d784d2dcbdb34b0eba9725a78c5816434ec8472164b3e6ad2c9ea9747056db1d1567a0ec0dc6975ede5264f7962dea3ecc94dd36a

    • SSDEEP

      1536:TyqlwNqlVZRGWY8HrIGtRSotDaZIPeKNDETGqVqbuFz1CSwx83wYk/8e8hR:Th6D3GtzD263qVeUESwx58e8hR

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks