General

  • Target

    l9941426.exe

  • Size

    168KB

  • Sample

    230509-2y56eaeh81

  • MD5

    8877a8fe69cbb52183c22ab577b71287

  • SHA1

    b315018ee73e946468733f44afd2a5b1e20d5d3d

  • SHA256

    cada58145e87ad1df4ef09c9a927343f6bc0e0cc72429146f57d529b7678a72e

  • SHA512

    28195c36e4a58a595ebbe2e6cf2262734380f4a44973cde4d1319264acb2c69c3fe710adb190fc76a87595cbcfce871a4fffcc785bf04385b58fdda672acefc3

  • SSDEEP

    1536:ifWUYxyGqlVZRGWFxDrkNla5RKDecm+sVsa+ZTGqVIbuSN5IDoVayvp83wYkB8e/:fwBN5fp+dLoqV4lIkVayvpr8e8hi

Malware Config

Extracted

Family

redline

Botnet

dease

C2

217.196.96.101:4132

Attributes
  • auth_value

    82e4d5f9abc21848e0345118814a4e6c

Targets

    • Target

      l9941426.exe

    • Size

      168KB

    • MD5

      8877a8fe69cbb52183c22ab577b71287

    • SHA1

      b315018ee73e946468733f44afd2a5b1e20d5d3d

    • SHA256

      cada58145e87ad1df4ef09c9a927343f6bc0e0cc72429146f57d529b7678a72e

    • SHA512

      28195c36e4a58a595ebbe2e6cf2262734380f4a44973cde4d1319264acb2c69c3fe710adb190fc76a87595cbcfce871a4fffcc785bf04385b58fdda672acefc3

    • SSDEEP

      1536:ifWUYxyGqlVZRGWFxDrkNla5RKDecm+sVsa+ZTGqVIbuSN5IDoVayvp83wYkB8e/:fwBN5fp+dLoqV4lIkVayvpr8e8hi

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks