General

  • Target

    0x003300000001ee7c-184.dat

  • Size

    168KB

  • Sample

    230510-mtme6sfe67

  • MD5

    df5e66869f4d915a3e20b45688061a8a

  • SHA1

    960a68d9262f7d334d93977e161b91f0d40dfec2

  • SHA256

    013f417d2c0e6873a93013896252ba13562da802756a7d5092ff9cab4148d56e

  • SHA512

    e4d1816d4f3e113b240f0d0828050253f5946669c5af2c9ad0ca61b852013cca697587c4fe61f09e2c6a06d0ef2b37c4b85227b630c32ee3ea5eeab3bc544f2e

  • SSDEEP

    3072:rC3YAOj8Wc2CC8cO7qV2k2obrgOdZ8e8hr:8YAh2CLdVOrgOdZ

Malware Config

Extracted

Family

redline

Botnet

mauga

C2

217.196.96.102:4132

Attributes
  • auth_value

    36f5411cf117f54076fbbb9ea0631fee

Targets

    • Target

      0x003300000001ee7c-184.dat

    • Size

      168KB

    • MD5

      df5e66869f4d915a3e20b45688061a8a

    • SHA1

      960a68d9262f7d334d93977e161b91f0d40dfec2

    • SHA256

      013f417d2c0e6873a93013896252ba13562da802756a7d5092ff9cab4148d56e

    • SHA512

      e4d1816d4f3e113b240f0d0828050253f5946669c5af2c9ad0ca61b852013cca697587c4fe61f09e2c6a06d0ef2b37c4b85227b630c32ee3ea5eeab3bc544f2e

    • SSDEEP

      3072:rC3YAOj8Wc2CC8cO7qV2k2obrgOdZ8e8hr:8YAh2CLdVOrgOdZ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks