General

  • Target

    0x0003000000021b0c-152.dat

  • Size

    145KB

  • Sample

    230521-qeqqtsac75

  • MD5

    466d931b72895d615d4aa6b36807479a

  • SHA1

    11701f8e52536871620c6fa91f4c748a3d5f8cb4

  • SHA256

    5fdb268047dd353bbdb04d198a954a120848563a94ab929bbbfbc29a699d5fec

  • SHA512

    d27e97973579ca0311f4711a99f202e5164601cf5ec467a238b67cf788c01c2c7d52691d1681075cd376410fc1a5db1746a8bb2e7d269c76707fb635c3e7c7c0

  • SSDEEP

    3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3

Malware Config

Extracted

Family

redline

Botnet

diza

C2

185.161.248.37:4138

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Targets

    • Target

      0x0003000000021b0c-152.dat

    • Size

      145KB

    • MD5

      466d931b72895d615d4aa6b36807479a

    • SHA1

      11701f8e52536871620c6fa91f4c748a3d5f8cb4

    • SHA256

      5fdb268047dd353bbdb04d198a954a120848563a94ab929bbbfbc29a699d5fec

    • SHA512

      d27e97973579ca0311f4711a99f202e5164601cf5ec467a238b67cf788c01c2c7d52691d1681075cd376410fc1a5db1746a8bb2e7d269c76707fb635c3e7c7c0

    • SSDEEP

      3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks