General

  • Target

    0x000900000001231b-78.dat

  • Size

    145KB

  • Sample

    230528-kxz5bsfb9s

  • MD5

    c95757fc36efa185f5429116810ae031

  • SHA1

    f3c0148e2735c0394c8c63e9a36071266f33f08d

  • SHA256

    099a994f096add96431a079ebb62cf203a0d062bc9006fe9b013eff88ff4ba6e

  • SHA512

    903224df27d4c2b975e88f5af3a3a2d6c9a1e1688d1125ddca0528f19c60a730c353418d6486a43c9c284626e71f8d07d1b25fee6fb4d05ea07e140c9a4fd400

  • SSDEEP

    3072:4V+m5chQmRSZ+HhlVr9vNLeEhEZt8e8hk:4jEzjeEhE3

Malware Config

Extracted

Family

redline

Botnet

duxa

C2

77.91.68.157:19065

Attributes
  • auth_value

    953a331341f07583fec00af44e01ec7d

Targets

    • Target

      0x000900000001231b-78.dat

    • Size

      145KB

    • MD5

      c95757fc36efa185f5429116810ae031

    • SHA1

      f3c0148e2735c0394c8c63e9a36071266f33f08d

    • SHA256

      099a994f096add96431a079ebb62cf203a0d062bc9006fe9b013eff88ff4ba6e

    • SHA512

      903224df27d4c2b975e88f5af3a3a2d6c9a1e1688d1125ddca0528f19c60a730c353418d6486a43c9c284626e71f8d07d1b25fee6fb4d05ea07e140c9a4fd400

    • SSDEEP

      3072:4V+m5chQmRSZ+HhlVr9vNLeEhEZt8e8hk:4jEzjeEhE3

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks