General

  • Target

    0x000600000001ae8f-172.dat

  • Size

    168KB

  • Sample

    230506-sgxm9sbh6y

  • MD5

    2227c129fb171681360f47431a2295ad

  • SHA1

    aad96ffce1374e09052cf0603e7369773b78e4e5

  • SHA256

    143618563b5ef3c6be00fd620f5b49b4f5a13eaa56b0cd22d59c375f5eba81a1

  • SHA512

    f0e33daf1fab9ffbc3ae13f51bd82761690a2cf1eb56b4b31e5cfdee5a042ac55e8b7fc376f01fba18f4c83ac31b5baa5384e5549cd0b33f62199d541acb978b

  • SSDEEP

    1536:2N+pfrkqlVZRGWPbrrVqmxPZbrsU0WSGGGGGGGGGGGGGGGGGtECK8TGqVGbunTeK:2N+pT99xRUxFqVSTYkNpD8e8hl

Malware Config

Extracted

Family

redline

Botnet

maxud

C2

217.196.96.101:4132

Attributes
  • auth_value

    f1403d964c52b6641ba1ef14803e6e74

Targets

    • Target

      0x000600000001ae8f-172.dat

    • Size

      168KB

    • MD5

      2227c129fb171681360f47431a2295ad

    • SHA1

      aad96ffce1374e09052cf0603e7369773b78e4e5

    • SHA256

      143618563b5ef3c6be00fd620f5b49b4f5a13eaa56b0cd22d59c375f5eba81a1

    • SHA512

      f0e33daf1fab9ffbc3ae13f51bd82761690a2cf1eb56b4b31e5cfdee5a042ac55e8b7fc376f01fba18f4c83ac31b5baa5384e5549cd0b33f62199d541acb978b

    • SSDEEP

      1536:2N+pfrkqlVZRGWPbrrVqmxPZbrsU0WSGGGGGGGGGGGGGGGGGtECK8TGqVGbunTeK:2N+pT99xRUxFqVSTYkNpD8e8hl

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks