General

  • Target

    0x000700000002315f-145.dat

  • Size

    168KB

  • Sample

    230504-kf6ksaba54

  • MD5

    be1e515ea229f4bd8379371d32fb5b23

  • SHA1

    7c52cd1467726a29abae807e15d45d14cbd21302

  • SHA256

    545ace0a985232678f2575854d68dba8d0942ae7148d1e7305fbaf77ce1a541f

  • SHA512

    7587bd94d28b80f6be3a99e08bb9af0074f342f676b6a8c55598e830b5546f0a5d3161914ee9db28bafb0e651dff928db0cb3ae56cb8af731aa31a5596325475

  • SSDEEP

    1536:Eq24CeDYZ5QqlVZRGWoysHrt3la3cOo+TGqV0buhoxW7/C6gX83wYk/8e8hK:EObYH2HaXEqVMVxI/C6gXh8e8hK

Malware Config

Extracted

Family

redline

Botnet

daris

C2

217.196.96.56:4138

Attributes
  • auth_value

    3491f24ae0250969cd45ce4b3fe77549

Targets

    • Target

      0x000700000002315f-145.dat

    • Size

      168KB

    • MD5

      be1e515ea229f4bd8379371d32fb5b23

    • SHA1

      7c52cd1467726a29abae807e15d45d14cbd21302

    • SHA256

      545ace0a985232678f2575854d68dba8d0942ae7148d1e7305fbaf77ce1a541f

    • SHA512

      7587bd94d28b80f6be3a99e08bb9af0074f342f676b6a8c55598e830b5546f0a5d3161914ee9db28bafb0e651dff928db0cb3ae56cb8af731aa31a5596325475

    • SSDEEP

      1536:Eq24CeDYZ5QqlVZRGWoysHrt3la3cOo+TGqV0buhoxW7/C6gX83wYk/8e8hK:EObYH2HaXEqVMVxI/C6gXh8e8hK

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks