General

  • Target

    0x00060000000142d3-106.dat

  • Size

    168KB

  • Sample

    230506-twshjahh54

  • MD5

    58944b014e806c582e74ae5115168889

  • SHA1

    338ba501a7e88eb9c097f7e9445d9156c92a1849

  • SHA256

    ede3af766e2c42fe4ebedbb6abc9a7b3c8bb7c94ebd5f74b7434108b479d135a

  • SHA512

    7b56b94eb578be54d2c86fead8ca577b66761c65a3a2eb35967623658b7c9799388abfccfb9224684f64b2f2b6a5b4fe76d7858111d08f939121b71eba12fef4

  • SSDEEP

    1536:PqDXowqlVZRGWJgOrbisl6BafXON1ETGqVgbux+9gzXpTE83wYkJ8e8h3:yD4TUsgc/61tqVwTqzXpTEL8e8h3

Malware Config

Extracted

Family

redline

Botnet

luna

C2

217.196.96.101:4132

Attributes
  • auth_value

    3372be6f6fa192ff878fa6fe9be73f6e

Targets

    • Target

      0x00060000000142d3-106.dat

    • Size

      168KB

    • MD5

      58944b014e806c582e74ae5115168889

    • SHA1

      338ba501a7e88eb9c097f7e9445d9156c92a1849

    • SHA256

      ede3af766e2c42fe4ebedbb6abc9a7b3c8bb7c94ebd5f74b7434108b479d135a

    • SHA512

      7b56b94eb578be54d2c86fead8ca577b66761c65a3a2eb35967623658b7c9799388abfccfb9224684f64b2f2b6a5b4fe76d7858111d08f939121b71eba12fef4

    • SSDEEP

      1536:PqDXowqlVZRGWJgOrbisl6BafXON1ETGqVgbux+9gzXpTE83wYkJ8e8h3:yD4TUsgc/61tqVwTqzXpTEL8e8h3

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks