General

  • Target

    0x00070000000139f8-93.dat

  • Size

    168KB

  • Sample

    230604-gfhxyabc84

  • MD5

    2bbb81dc7332a891afa8121426f06956

  • SHA1

    79688c07e801bc328af8d0cdc66e17b2320f654b

  • SHA256

    555d151d72546be49a463f91d3528d1f442cb062796bd0c0968b8aebb2714ed0

  • SHA512

    b79ca31fcbb1a905b5b77bb53ca868e78c94292581280a4ff84ecd2569a64440bac4553ec14a5e65a1acda98732a011110fc3c3798216ec3de9dacdd171285c2

  • SSDEEP

    3072:CemQ6p8Wc6+yoIyqCqVMEODInQ6FR8e8h5:CemBY6oIyvjGnQ6FR

Malware Config

Extracted

Family

redline

Botnet

dusa

C2

83.97.73.126:19046

Attributes
  • auth_value

    ee896466545fedf9de5406175fb82de5

Targets

    • Target

      0x00070000000139f8-93.dat

    • Size

      168KB

    • MD5

      2bbb81dc7332a891afa8121426f06956

    • SHA1

      79688c07e801bc328af8d0cdc66e17b2320f654b

    • SHA256

      555d151d72546be49a463f91d3528d1f442cb062796bd0c0968b8aebb2714ed0

    • SHA512

      b79ca31fcbb1a905b5b77bb53ca868e78c94292581280a4ff84ecd2569a64440bac4553ec14a5e65a1acda98732a011110fc3c3798216ec3de9dacdd171285c2

    • SSDEEP

      3072:CemQ6p8Wc6+yoIyqCqVMEODInQ6FR8e8h5:CemBY6oIyvjGnQ6FR

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks