General

  • Target

    0x000800000001231c116.dat.exe

  • Size

    145KB

  • Sample

    230518-qzrtmaab9t

  • MD5

    b89285939f9ae303ed7ea9e657df583c

  • SHA1

    86e9df77d27a2768b56b4d60019c75889dfc6e14

  • SHA256

    b26b5869fbe88ace72052a934115ded2af8ba53f2b62c9cf42040ee416978b6c

  • SHA512

    98d8bffaa92464240557b5d7a747593f0ca9ce709646e620caa499171ae2d0797a43cf8fb5cc442c359daae1030434007f31c2b57e6e29db9dbeaec847102095

  • SSDEEP

    3072:FV+m5c/QmRSNAwMqLza9nDEFth2ZG8e8hR:Fj2FD0IQth2c

Malware Config

Extracted

Family

redline

Botnet

luna

C2

77.91.68.253:4138

Attributes
  • auth_value

    16dec8addb01db1c11c59667022ef7a2

Targets

    • Target

      0x000800000001231c116.dat.exe

    • Size

      145KB

    • MD5

      b89285939f9ae303ed7ea9e657df583c

    • SHA1

      86e9df77d27a2768b56b4d60019c75889dfc6e14

    • SHA256

      b26b5869fbe88ace72052a934115ded2af8ba53f2b62c9cf42040ee416978b6c

    • SHA512

      98d8bffaa92464240557b5d7a747593f0ca9ce709646e620caa499171ae2d0797a43cf8fb5cc442c359daae1030434007f31c2b57e6e29db9dbeaec847102095

    • SSDEEP

      3072:FV+m5c/QmRSNAwMqLza9nDEFth2ZG8e8hR:Fj2FD0IQth2c

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks