General

  • Target

    0x0004000000000733-145.dat

  • Size

    168KB

  • Sample

    230504-had78sad32

  • MD5

    42da972b310f030ea80df42d8fbef6e5

  • SHA1

    5b4fbae4c6a4d463784f2ef44205afdf15e7c6e4

  • SHA256

    eae09a694d905cf44d59f0d65a658411f3e9e5fc13c1ebb961596c66408e9db3

  • SHA512

    96c2ac53b0c1b0c4b934161c2402abeb788ac79693fe23a30bafeea5474a05addc326782649f5d7bfa1d0635bc69fc6fbcedfacbeac9bac0b26ea03ec1418bec

  • SSDEEP

    1536:bO5wJnqlVZRGWbD7irbYzNegMVBq0ZjTGqVQbuVP6yue/b83wYkz8e8hy:bO566sYOqAuqVgc63e/bt8e8hy

Malware Config

Extracted

Family

redline

Botnet

darm

C2

217.196.96.56:4138

Attributes
  • auth_value

    d88ac8ccc04ab9979b04b46313db1648

Targets

    • Target

      0x0004000000000733-145.dat

    • Size

      168KB

    • MD5

      42da972b310f030ea80df42d8fbef6e5

    • SHA1

      5b4fbae4c6a4d463784f2ef44205afdf15e7c6e4

    • SHA256

      eae09a694d905cf44d59f0d65a658411f3e9e5fc13c1ebb961596c66408e9db3

    • SHA512

      96c2ac53b0c1b0c4b934161c2402abeb788ac79693fe23a30bafeea5474a05addc326782649f5d7bfa1d0635bc69fc6fbcedfacbeac9bac0b26ea03ec1418bec

    • SSDEEP

      1536:bO5wJnqlVZRGWbD7irbYzNegMVBq0ZjTGqVQbuVP6yue/b83wYkz8e8hy:bO566sYOqAuqVgc63e/bt8e8hy

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks