General

  • Target

    0x00070000000134bf-93.dat

  • Size

    168KB

  • Sample

    230603-d5kahsfc92

  • MD5

    ee68d30aac163c77b36803b74e19c04a

  • SHA1

    876a9176777f55dae3e59737d761132c14bca012

  • SHA256

    be77569dc5bec13d2552f3dd3b95de54a1fad1366ad9bdb8267332ac92a392a5

  • SHA512

    d6322398377c2d08d2b6109f51be19c6061ddf1aba40d47c1108be73fa630d63d0b677a6129684c0fa7fabd8f8c993ac45ba4dd0edee67ae4f33baa18b58073b

  • SSDEEP

    3072:NPAVVKve8WCXYFlqVsg4/ywuHx8nB8e8hE:ZAVV+rX0DZFuHx8nB

Malware Config

Extracted

Family

redline

Botnet

lupa

C2

83.97.73.126:19046

Attributes
  • auth_value

    6a764aa41830c77712442516d143bc9c

Targets

    • Target

      0x00070000000134bf-93.dat

    • Size

      168KB

    • MD5

      ee68d30aac163c77b36803b74e19c04a

    • SHA1

      876a9176777f55dae3e59737d761132c14bca012

    • SHA256

      be77569dc5bec13d2552f3dd3b95de54a1fad1366ad9bdb8267332ac92a392a5

    • SHA512

      d6322398377c2d08d2b6109f51be19c6061ddf1aba40d47c1108be73fa630d63d0b677a6129684c0fa7fabd8f8c993ac45ba4dd0edee67ae4f33baa18b58073b

    • SSDEEP

      3072:NPAVVKve8WCXYFlqVsg4/ywuHx8nB8e8hE:ZAVV+rX0DZFuHx8nB

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks