General

  • Target

    0x0006000000014aa1-96.dat

  • Size

    168KB

  • Sample

    230604-ekpvyabe7v

  • MD5

    ce69a683055476f7a8de0ef660450c68

  • SHA1

    f32eef57545ca96a05e6b5cb779720ac4db60565

  • SHA256

    eadf3a12ace41dd8365ce1e74022de45ab8a9a14a9b7c24d7b9f2b7c18f086e6

  • SHA512

    11cd362afd840d0299deeafd1847fb58ccee110a1811f4342adec97737e3ffd3315a1f2c0e67d955b0d2d5ad796499cd78a15861f13c1ade1f9482b15a006f51

  • SSDEEP

    3072:CemQ6p8Wc6+yoIyqCqVMEODInQ6FR8e8h5:CemBY6oIyvjGnQ6FR

Malware Config

Extracted

Family

redline

Botnet

dusa

C2

83.97.73.126:19046

Attributes
  • auth_value

    ee896466545fedf9de5406175fb82de5

Targets

    • Target

      0x0006000000014aa1-96.dat

    • Size

      168KB

    • MD5

      ce69a683055476f7a8de0ef660450c68

    • SHA1

      f32eef57545ca96a05e6b5cb779720ac4db60565

    • SHA256

      eadf3a12ace41dd8365ce1e74022de45ab8a9a14a9b7c24d7b9f2b7c18f086e6

    • SHA512

      11cd362afd840d0299deeafd1847fb58ccee110a1811f4342adec97737e3ffd3315a1f2c0e67d955b0d2d5ad796499cd78a15861f13c1ade1f9482b15a006f51

    • SSDEEP

      3072:CemQ6p8Wc6+yoIyqCqVMEODInQ6FR8e8h5:CemBY6oIyvjGnQ6FR

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks