General

  • Target

    0x0006000000023134-191.dat

  • Size

    168KB

  • Sample

    230511-t5an3sgf58

  • MD5

    3a49be5cdae6705bce250bf17a9729a0

  • SHA1

    d7e3265360e5516980a839b9638338b722ce290e

  • SHA256

    b08c9b5fbd5c8a5f35d9278d7c6337cf1ba329d9ad810095d683d43317d849ad

  • SHA512

    53a892b1a2d94d8d15c64a707d15f2c51c1ac6d317af18e98837c98f5aea4de6320d88eb942e82202f37bdbac77c96c0d019f02c257bfb1cf6ca4c6cf15983f0

  • SSDEEP

    3072:8kmfv4r8W2qTvI2t2qVwoMTOIkvl98e8hg:gfvhZ/Rfkvl9

Malware Config

Extracted

Family

redline

Botnet

mixa

C2

185.161.248.75:4132

Attributes
  • auth_value

    9d14534b25ac495ab25b59800acf3bb2

Targets

    • Target

      0x0006000000023134-191.dat

    • Size

      168KB

    • MD5

      3a49be5cdae6705bce250bf17a9729a0

    • SHA1

      d7e3265360e5516980a839b9638338b722ce290e

    • SHA256

      b08c9b5fbd5c8a5f35d9278d7c6337cf1ba329d9ad810095d683d43317d849ad

    • SHA512

      53a892b1a2d94d8d15c64a707d15f2c51c1ac6d317af18e98837c98f5aea4de6320d88eb942e82202f37bdbac77c96c0d019f02c257bfb1cf6ca4c6cf15983f0

    • SSDEEP

      3072:8kmfv4r8W2qTvI2t2qVwoMTOIkvl98e8hg:gfvhZ/Rfkvl9

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks