General

  • Target

    0x00080000000122f4-117.dat

  • Size

    145KB

  • Sample

    230515-jsb19shg2v

  • MD5

    8e27eeb0de7acbe311ce74918438942c

  • SHA1

    3dd31880e3383b1b9ef3b867a4558ad9d379005a

  • SHA256

    9c5a328f5d2866ae0b8fec9e346dd8836eba2a64af069a983b83f3f6d363443b

  • SHA512

    354313b156aeae5b2ac2dfe94f3c1631d753699e7cb2cba4ef1340072b60a74888ee090b9f25c55d63ed567495edfd52e6d9c0ad43b45d8ff99920f349ce5147

  • SSDEEP

    3072:nV+m5czQmRS9I6E24dl3CZz3FhRZG8e8hT:njKmE2WcTFhR8

Malware Config

Extracted

Family

redline

Botnet

masta

C2

185.161.248.75:4132

Attributes
  • auth_value

    57f23b6b74d0f680c5a0c8ac9f52bd75

Targets

    • Target

      0x00080000000122f4-117.dat

    • Size

      145KB

    • MD5

      8e27eeb0de7acbe311ce74918438942c

    • SHA1

      3dd31880e3383b1b9ef3b867a4558ad9d379005a

    • SHA256

      9c5a328f5d2866ae0b8fec9e346dd8836eba2a64af069a983b83f3f6d363443b

    • SHA512

      354313b156aeae5b2ac2dfe94f3c1631d753699e7cb2cba4ef1340072b60a74888ee090b9f25c55d63ed567495edfd52e6d9c0ad43b45d8ff99920f349ce5147

    • SSDEEP

      3072:nV+m5czQmRS9I6E24dl3CZz3FhRZG8e8hT:njKmE2WcTFhR8

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks