General

  • Target

    0x00090000000122eb-78.dat

  • Size

    172KB

  • Sample

    230607-x8q21sfa42

  • MD5

    7bcecfeac605bfed152ef07008e486a9

  • SHA1

    108b6b37b31905ba9899fd55bbac27eb4eb35998

  • SHA256

    07f3e973c0f3bd337c2668a340dc520ddb6c82ac60c5c7b738c9d18edd511bba

  • SHA512

    d52647248f49eb03024d9f2d95bafaf1760e41420c2acb16c279c0a5f7769e4a8ecbf29674fc34f24a7eb66482a97674aef8bedb0ee5eb37b64d5a180a129ea2

  • SSDEEP

    1536:gtaPgzl736sv0W7Tp8JFrH4ySLn1nbAxNTIYQ/dbumgzeFra6l0GkR88e8hZ:g6gJBO0y6RbAxNjgOqFra6l/8e8hZ

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.129:19068

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Targets

    • Target

      0x00090000000122eb-78.dat

    • Size

      172KB

    • MD5

      7bcecfeac605bfed152ef07008e486a9

    • SHA1

      108b6b37b31905ba9899fd55bbac27eb4eb35998

    • SHA256

      07f3e973c0f3bd337c2668a340dc520ddb6c82ac60c5c7b738c9d18edd511bba

    • SHA512

      d52647248f49eb03024d9f2d95bafaf1760e41420c2acb16c279c0a5f7769e4a8ecbf29674fc34f24a7eb66482a97674aef8bedb0ee5eb37b64d5a180a129ea2

    • SSDEEP

      1536:gtaPgzl736sv0W7Tp8JFrH4ySLn1nbAxNTIYQ/dbumgzeFra6l0GkR88e8hZ:g6gJBO0y6RbAxNjgOqFra6l/8e8hZ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks