General

  • Target

    0x00090000000122f6-78.dat

  • Size

    168KB

  • Sample

    230603-frr5bafe96

  • MD5

    5b245224234b3448b86a08f8853ca48b

  • SHA1

    4485dea4bc62d18fc10041d6d7a478703c6f8464

  • SHA256

    8e605cc8c66c8ba9ae2d0673ac2a1db3a3e38f6c6a6a5c487688e99eb4d81d5c

  • SHA512

    8ef8413b156c547189a4639e31f65b80cb6c0b34f8d572be7402bf2e416d5c9a937b11359f396d743a08036211def15c3bc329f148fba2ff4c7de814cc814322

  • SSDEEP

    3072:o3b2AH8WzSEXrWS0qVyMAFWqsvP2mwQM8e8hu:o3b5N/IJ0P2mwQM

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.126:19046

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Targets

    • Target

      0x00090000000122f6-78.dat

    • Size

      168KB

    • MD5

      5b245224234b3448b86a08f8853ca48b

    • SHA1

      4485dea4bc62d18fc10041d6d7a478703c6f8464

    • SHA256

      8e605cc8c66c8ba9ae2d0673ac2a1db3a3e38f6c6a6a5c487688e99eb4d81d5c

    • SHA512

      8ef8413b156c547189a4639e31f65b80cb6c0b34f8d572be7402bf2e416d5c9a937b11359f396d743a08036211def15c3bc329f148fba2ff4c7de814cc814322

    • SSDEEP

      3072:o3b2AH8WzSEXrWS0qVyMAFWqsvP2mwQM8e8hu:o3b5N/IJ0P2mwQM

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks