General

  • Target

    dfbe7ab4102572f02a36b5fd92fb63ec918422b9c16accea05b891d5dfb3554e

  • Size

    256KB

  • Sample

    230616-aspgxsbh2v

  • MD5

    21d3dee165fe76ab243f8e1b547f7dc3

  • SHA1

    ea4d2a7fef5783abb3971b5d7e48a15c41b66f37

  • SHA256

    dfbe7ab4102572f02a36b5fd92fb63ec918422b9c16accea05b891d5dfb3554e

  • SHA512

    f0c62070b94ae04147ae69139bb481e60b828158a745a29aede39432612f72ccd6d7489fa05874d3afc02a6b57092109298fb9b9684ac536e6c79b45d475a3f2

  • SSDEEP

    6144:kjcod0r0TZC4xR4aPYaD4hYhJWJSW/Ve7C:H/0TZCO4r9

Malware Config

Extracted

Family

redline

Botnet

joker

C2

83.97.73.130:19061

Attributes
  • auth_value

    a98d303cc28bb3b32a23c59214ae3bc0

Targets

    • Target

      dfbe7ab4102572f02a36b5fd92fb63ec918422b9c16accea05b891d5dfb3554e

    • Size

      256KB

    • MD5

      21d3dee165fe76ab243f8e1b547f7dc3

    • SHA1

      ea4d2a7fef5783abb3971b5d7e48a15c41b66f37

    • SHA256

      dfbe7ab4102572f02a36b5fd92fb63ec918422b9c16accea05b891d5dfb3554e

    • SHA512

      f0c62070b94ae04147ae69139bb481e60b828158a745a29aede39432612f72ccd6d7489fa05874d3afc02a6b57092109298fb9b9684ac536e6c79b45d475a3f2

    • SSDEEP

      6144:kjcod0r0TZC4xR4aPYaD4hYhJWJSW/Ve7C:H/0TZCO4r9

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks