General

  • Target

    0x0007000000013990-93.dat

  • Size

    168KB

  • Sample

    230602-a9heyahe7t

  • MD5

    8ab080c0c1162a8518deca87738ce207

  • SHA1

    4693d867aaa2a136a52921bb28340ae5327335af

  • SHA256

    1509bb72e43d5d58869a6875bccb56eeabb765d964ef55ea2b3b2fd32a09c6c5

  • SHA512

    935979e14344e0ca36a58697259eee00eb96f792e07bdd3da14a3a5dcc2db5b359f87362316c650605b6321000c63faa0d86a7fd9e6b8934d76b700e871e2e64

  • SSDEEP

    3072:I9s3StL8WCNV5yDqVgYRNYvSgvQF2kt8e8hY:I+36wNvyDvvvSgvQF2kt

Malware Config

Extracted

Family

redline

Botnet

mars

C2

83.97.73.127:19045

Attributes
  • auth_value

    91bd3682cfb50cdc64b6009eb977b766

Targets

    • Target

      0x0007000000013990-93.dat

    • Size

      168KB

    • MD5

      8ab080c0c1162a8518deca87738ce207

    • SHA1

      4693d867aaa2a136a52921bb28340ae5327335af

    • SHA256

      1509bb72e43d5d58869a6875bccb56eeabb765d964ef55ea2b3b2fd32a09c6c5

    • SHA512

      935979e14344e0ca36a58697259eee00eb96f792e07bdd3da14a3a5dcc2db5b359f87362316c650605b6321000c63faa0d86a7fd9e6b8934d76b700e871e2e64

    • SSDEEP

      3072:I9s3StL8WCNV5yDqVgYRNYvSgvQF2kt8e8hY:I+36wNvyDvvvSgvQF2kt

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks