General

  • Target

    0x00080000000122e9-118.dat

  • Size

    172KB

  • Sample

    230612-mc1lgabd42

  • MD5

    ba56a4bf78d0def0b64f3036e84d4b9a

  • SHA1

    5f7909b81d6ec4b1119db7e7287a73570bed270e

  • SHA256

    be680fafcdd765c516bd6a654e2285d2e736a9014e5050e0bf0d5c41c7b669ee

  • SHA512

    ce478dadbdeb44133ab816f3a69fe21ce304d47482fa8ecb4c7779c7d955d96a7310dbf54e05ba4ed9a67f172f1fc4942b2f42fa0eaea6dca972b045a81bc7c8

  • SSDEEP

    3072:K8nuTgW9sNDRb1dxNsKuqWUyZfg+D8e8h+:K8n3l116BUyZfg+D

Malware Config

Extracted

Family

redline

Botnet

moro

C2

83.97.73.129:19068

Attributes
  • auth_value

    24d4f20def584fcfb9067c13ead26e63

Targets

    • Target

      0x00080000000122e9-118.dat

    • Size

      172KB

    • MD5

      ba56a4bf78d0def0b64f3036e84d4b9a

    • SHA1

      5f7909b81d6ec4b1119db7e7287a73570bed270e

    • SHA256

      be680fafcdd765c516bd6a654e2285d2e736a9014e5050e0bf0d5c41c7b669ee

    • SHA512

      ce478dadbdeb44133ab816f3a69fe21ce304d47482fa8ecb4c7779c7d955d96a7310dbf54e05ba4ed9a67f172f1fc4942b2f42fa0eaea6dca972b045a81bc7c8

    • SSDEEP

      3072:K8nuTgW9sNDRb1dxNsKuqWUyZfg+D8e8h+:K8n3l116BUyZfg+D

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks