General

  • Target

    0x000700000001398f-115.dat

  • Size

    168KB

  • Sample

    230510-xyzleahh74

  • MD5

    a3482b08315a088cba3bc3ae8cf0f987

  • SHA1

    067e19da8b24e6093a46bcd11c7edd6dd949039e

  • SHA256

    63e9e250ca5744a2514ab2cf7a5d6790fca43b8d9b297259d6b0ed8985dec988

  • SHA512

    3d4ea3d4f5acb31756010bb0bc6551494a9495ace588244d20ed9eaf2f69b2a8ccb8824d6ffaa807ebbccd860217698c9e8b6d882ead0e48f7e5eb58dd7f0f2a

  • SSDEEP

    1536:OG9+ioRqhVZCGWlxZPO78WRJJMETYOBT3lTGqVcNWbukUBMiGC84wYk48e8hh:OG+DW8WjdVBbcqVcU+2iGC98e8hh

Malware Config

Extracted

Family

redline

Botnet

misik

C2

217.196.96.102:4132

Attributes
  • auth_value

    9133827666bc8f4b05339316460b08aa

Targets

    • Target

      0x000700000001398f-115.dat

    • Size

      168KB

    • MD5

      a3482b08315a088cba3bc3ae8cf0f987

    • SHA1

      067e19da8b24e6093a46bcd11c7edd6dd949039e

    • SHA256

      63e9e250ca5744a2514ab2cf7a5d6790fca43b8d9b297259d6b0ed8985dec988

    • SHA512

      3d4ea3d4f5acb31756010bb0bc6551494a9495ace588244d20ed9eaf2f69b2a8ccb8824d6ffaa807ebbccd860217698c9e8b6d882ead0e48f7e5eb58dd7f0f2a

    • SSDEEP

      1536:OG9+ioRqhVZCGWlxZPO78WRJJMETYOBT3lTGqVcNWbukUBMiGC84wYk48e8hh:OG+DW8WjdVBbcqVcU+2iGC98e8hh

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks