General

  • Target

    0x0006000000014b97-107.dat

  • Size

    168KB

  • Sample

    230508-pph83acd3x

  • MD5

    0fb6a740cec81575706f282ccd0dc023

  • SHA1

    5bc54bf931ba8568d5783f57d227dcc691701ad3

  • SHA256

    9c423ccb27b59d82726f964ecae892720daafc7a37450e6b0227a72d80086f80

  • SHA512

    c14e218eb8130a05da1fa71dff6212940f6cfc2366e771b3406cdaddc3d4099c65e9a245640a2ff197656d6ec25bab732f61bec38fbfd2a20b1d8033cc63c7c7

  • SSDEEP

    3072:TKGk00DcQO1y56qVemIWrnDCv2y8e8hZ:WGk0qcdy56chnDCv2y

Malware Config

Extracted

Family

redline

Botnet

dona

C2

217.196.96.101:4132

Attributes
  • auth_value

    9fbb198992bbc83a84ab1f21384813e3

Targets

    • Target

      0x0006000000014b97-107.dat

    • Size

      168KB

    • MD5

      0fb6a740cec81575706f282ccd0dc023

    • SHA1

      5bc54bf931ba8568d5783f57d227dcc691701ad3

    • SHA256

      9c423ccb27b59d82726f964ecae892720daafc7a37450e6b0227a72d80086f80

    • SHA512

      c14e218eb8130a05da1fa71dff6212940f6cfc2366e771b3406cdaddc3d4099c65e9a245640a2ff197656d6ec25bab732f61bec38fbfd2a20b1d8033cc63c7c7

    • SSDEEP

      3072:TKGk00DcQO1y56qVemIWrnDCv2y8e8hZ:WGk0qcdy56chnDCv2y

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks