General

  • Target

    0x0004000000000731-145.dat

  • Size

    168KB

  • Sample

    230504-hg4fpscc9z

  • MD5

    6ead7d5aa9a0ddfa6b6e932244ac77b7

  • SHA1

    8ca7ae09fc71ea0a70fcfcb9ae3fa30729f51eab

  • SHA256

    58ea2be9820824e13dd7d27bced255cf866f50a233994862319ff5cc3a4c8306

  • SHA512

    748c42016d38a4f2acdb83250a8cfbaf5258c35b3366631243a79a0f4fb99db3c1a506626d4e18cc9ad08b4aecbbb1b75b52d0a3120214d89512e1ef7186e1eb

  • SSDEEP

    1536:Eq24CeDYZ5QqlVZRGWoysHrt3la3cOo+TGqV0buhoxW7/C6gX83wYk/8e8hK:EObYH2HaXEqVMVxI/C6gXh8e8hK

Malware Config

Extracted

Family

redline

Botnet

daris

C2

217.196.96.56:4138

Attributes
  • auth_value

    3491f24ae0250969cd45ce4b3fe77549

Targets

    • Target

      0x0004000000000731-145.dat

    • Size

      168KB

    • MD5

      6ead7d5aa9a0ddfa6b6e932244ac77b7

    • SHA1

      8ca7ae09fc71ea0a70fcfcb9ae3fa30729f51eab

    • SHA256

      58ea2be9820824e13dd7d27bced255cf866f50a233994862319ff5cc3a4c8306

    • SHA512

      748c42016d38a4f2acdb83250a8cfbaf5258c35b3366631243a79a0f4fb99db3c1a506626d4e18cc9ad08b4aecbbb1b75b52d0a3120214d89512e1ef7186e1eb

    • SSDEEP

      1536:Eq24CeDYZ5QqlVZRGWoysHrt3la3cOo+TGqV0buhoxW7/C6gX83wYk/8e8hK:EObYH2HaXEqVMVxI/C6gXh8e8hK

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks