General

  • Target

    file.exe

  • Size

    315KB

  • Sample

    230614-f65c7adb59

  • MD5

    1730aa5475a43d8f889faf7208bbabc5

  • SHA1

    c196ca36073ad9439c4dd76c8089ed0dfa95fa6d

  • SHA256

    187a40c80f0e837cdce06aae645e185e8da0b82f7ef922f83cff3e4fa27ac421

  • SHA512

    a06fc9d08a48d703d35630a0a55257ef6aefae51246838e15dc64003020e57fa5aaf4eefc436a9aa19dd22b0727e7b81a572e2bfc39468ecabf6dc034f054f86

  • SSDEEP

    6144:/OgXRtRV25aqTLI5gWWIoX3VWXPzRUITun:PRXA5BTLyPzRUI

Malware Config

Extracted

Family

redline

Botnet

lux3

C2

176.123.9.142:14845

Attributes
  • auth_value

    e94dff9a76da90d6b000642c4a52574b

Targets

    • Target

      file.exe

    • Size

      315KB

    • MD5

      1730aa5475a43d8f889faf7208bbabc5

    • SHA1

      c196ca36073ad9439c4dd76c8089ed0dfa95fa6d

    • SHA256

      187a40c80f0e837cdce06aae645e185e8da0b82f7ef922f83cff3e4fa27ac421

    • SHA512

      a06fc9d08a48d703d35630a0a55257ef6aefae51246838e15dc64003020e57fa5aaf4eefc436a9aa19dd22b0727e7b81a572e2bfc39468ecabf6dc034f054f86

    • SSDEEP

      6144:/OgXRtRV25aqTLI5gWWIoX3VWXPzRUITun:PRXA5BTLyPzRUI

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks