General

  • Target

    f7620125exe.exe

  • Size

    250KB

  • Sample

    230627-rred1afd6w

  • MD5

    31abaa02e790e59c13edd7198ac4b167

  • SHA1

    b98aefdbe07774ea90fbb87b12e37f771bc0c272

  • SHA256

    a7ab02f847eef150490bbf7ddd0ccda325e6aa05a4a7d64f7e3c3be40c4be59e

  • SHA512

    fc6c4bc57e0292855cb0f7590439effd6faf33efc272dfa6ed7b08767424e2556c35b173227cf2d56565645c6d8e8ed77659b226dc12962cad08722f3ab8c00e

  • SSDEEP

    3072:SubbAyO8byfkn6Y/wHKW/Gl2VfXu58w4S1lwNirkqNKHnJiIJHpCusBjnAuU06Be:SdyUk6r/ECXY8w4SkN4eipLAIZ3r

Malware Config

Extracted

Family

redline

Botnet

smoke

C2

83.97.73.131:19071

Attributes
  • auth_value

    aaa47198b84c95fcce9397339e8af9d4

Targets

    • Target

      f7620125exe.exe

    • Size

      250KB

    • MD5

      31abaa02e790e59c13edd7198ac4b167

    • SHA1

      b98aefdbe07774ea90fbb87b12e37f771bc0c272

    • SHA256

      a7ab02f847eef150490bbf7ddd0ccda325e6aa05a4a7d64f7e3c3be40c4be59e

    • SHA512

      fc6c4bc57e0292855cb0f7590439effd6faf33efc272dfa6ed7b08767424e2556c35b173227cf2d56565645c6d8e8ed77659b226dc12962cad08722f3ab8c00e

    • SSDEEP

      3072:SubbAyO8byfkn6Y/wHKW/Gl2VfXu58w4S1lwNirkqNKHnJiIJHpCusBjnAuU06Be:SdyUk6r/ECXY8w4SkN4eipLAIZ3r

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks