General

  • Target

    45c97327556ba14ef7a0ba54fd859d12.exe

  • Size

    262KB

  • Sample

    230702-tjwdnaca26

  • MD5

    45c97327556ba14ef7a0ba54fd859d12

  • SHA1

    540b1ed42d75c7b31ef644617539f5a1f68d8cc9

  • SHA256

    664e89a22b160554e5e460ef6c89f86dbdef4e8ed32f0170959ad569e304012a

  • SHA512

    730dbf0f1a0b7ef94eda567483f987be0e5a8bd067685726bab92762dc217c87b8492fb42198f8f56b90d3864d6cf1281d72359dbd78b18dfffe2c28c5b41c3f

  • SSDEEP

    3072:7lfo9GkoWs48UWBFyJhVbyLNLd7m4tJOyXSwl2vTyf2uV+r5y7ZwYWWfozpejxk:RopoM8UxIpLdC4t8yXzU7mQ0l56

Malware Config

Extracted

Family

redline

Botnet

andre

C2

77.91.124.49:19073

Attributes
  • auth_value

    8e5522dc6bdb7e288797bc46c2687b12

Targets

    • Target

      45c97327556ba14ef7a0ba54fd859d12.exe

    • Size

      262KB

    • MD5

      45c97327556ba14ef7a0ba54fd859d12

    • SHA1

      540b1ed42d75c7b31ef644617539f5a1f68d8cc9

    • SHA256

      664e89a22b160554e5e460ef6c89f86dbdef4e8ed32f0170959ad569e304012a

    • SHA512

      730dbf0f1a0b7ef94eda567483f987be0e5a8bd067685726bab92762dc217c87b8492fb42198f8f56b90d3864d6cf1281d72359dbd78b18dfffe2c28c5b41c3f

    • SSDEEP

      3072:7lfo9GkoWs48UWBFyJhVbyLNLd7m4tJOyXSwl2vTyf2uV+r5y7ZwYWWfozpejxk:RopoM8UxIpLdC4t8yXzU7mQ0l56

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks