General

  • Target

    f6594919.exe

  • Size

    274KB

  • Sample

    230630-e5sgkaha3v

  • MD5

    bd37d786ee935b8b9f00782d89340147

  • SHA1

    00be941ffe99a4a12e3d467b0f7cf26977503c27

  • SHA256

    f55d556999d5531f6e7880d973ba36696c063adc14ef5d5f9552aaa9e43be78b

  • SHA512

    741ac5542f33319bdb53df8378ef13f648d228bed38ce399b34382115dfdff12f49f71cc83dc420c2671eba0a8163ce86b4d35ba2a4e75b718adb4e709c168b1

  • SSDEEP

    6144:HAoxuYs/pPrgH3Vsmci25sndkzOYFwKBbvoEldxwo7eIvukEaJOjrlzgUCNvZAtn:JxuY8pTgkdxDeIbEaJOjrlzgUCNBAlZD

Malware Config

Extracted

Family

redline

Botnet

smoke

C2

83.97.73.131:19071

Attributes
  • auth_value

    aaa47198b84c95fcce9397339e8af9d4

Targets

    • Target

      f6594919.exe

    • Size

      274KB

    • MD5

      bd37d786ee935b8b9f00782d89340147

    • SHA1

      00be941ffe99a4a12e3d467b0f7cf26977503c27

    • SHA256

      f55d556999d5531f6e7880d973ba36696c063adc14ef5d5f9552aaa9e43be78b

    • SHA512

      741ac5542f33319bdb53df8378ef13f648d228bed38ce399b34382115dfdff12f49f71cc83dc420c2671eba0a8163ce86b4d35ba2a4e75b718adb4e709c168b1

    • SSDEEP

      6144:HAoxuYs/pPrgH3Vsmci25sndkzOYFwKBbvoEldxwo7eIvukEaJOjrlzgUCNvZAtn:JxuY8pTgkdxDeIbEaJOjrlzgUCNBAlZD

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks