General

  • Target

    0x0006000000014ad2-116.dat

  • Size

    145KB

  • Sample

    230520-w21r7sgf8x

  • MD5

    e122b065cbf869fbe679952a1f6f1be3

  • SHA1

    cb22a48462597ed4d79fce67ed5588b415bcec49

  • SHA256

    7fb42a6b9bf10e368a45536b76b2406dfc5653cf5c1253022f3396c2344a13a1

  • SHA512

    e1520c30b64e11891a04494f4f85cb6e5a58347b38728d872ce89a1109990c39205f0921a001679bcf223a61482a6ab52ed21a4916826f3316aeb909dcad63d8

  • SSDEEP

    3072:2V+m5cNQmRSxWWAcP+DDXedh7Z58e8hk:2jwCUudh7z

Malware Config

Extracted

Family

redline

Botnet

duper

C2

77.91.68.253:19065

Attributes
  • auth_value

    57e17ebbdb18f4882b95fe05402ef1c8

Targets

    • Target

      0x0006000000014ad2-116.dat

    • Size

      145KB

    • MD5

      e122b065cbf869fbe679952a1f6f1be3

    • SHA1

      cb22a48462597ed4d79fce67ed5588b415bcec49

    • SHA256

      7fb42a6b9bf10e368a45536b76b2406dfc5653cf5c1253022f3396c2344a13a1

    • SHA512

      e1520c30b64e11891a04494f4f85cb6e5a58347b38728d872ce89a1109990c39205f0921a001679bcf223a61482a6ab52ed21a4916826f3316aeb909dcad63d8

    • SSDEEP

      3072:2V+m5cNQmRSxWWAcP+DDXedh7Z58e8hk:2jwCUudh7z

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks