General

  • Target

    l0296190.exe

  • Size

    262KB

  • Sample

    230703-e33jrafh6z

  • MD5

    c658418c288935549905d254c2157949

  • SHA1

    0000668a8286fcf5d837ab5f8e617b3e3895962d

  • SHA256

    961208ebefb9a72f0cbe2a4c76a52fefe132c5406b39d39cda2a1ca32aaa9211

  • SHA512

    1bcc640688385bd88ca3881828abb80157ecfa23fe7741a7f0c1a0c1674d31935979b34c43148e0014577a681aff4480ad62569ac485861189916c4d496ba2ac

  • SSDEEP

    3072:c5dhlySNGb4ndosyJhVbyLNLd7m4tJOyXSwl2vTyf2uV+r5y7ZwYWWvkpejxM:ZSNRndSIpLdC4t8yXzU7mQ0lxg

Malware Config

Extracted

Family

redline

Botnet

andre

C2

77.91.124.49:19073

Attributes
  • auth_value

    8e5522dc6bdb7e288797bc46c2687b12

Targets

    • Target

      l0296190.exe

    • Size

      262KB

    • MD5

      c658418c288935549905d254c2157949

    • SHA1

      0000668a8286fcf5d837ab5f8e617b3e3895962d

    • SHA256

      961208ebefb9a72f0cbe2a4c76a52fefe132c5406b39d39cda2a1ca32aaa9211

    • SHA512

      1bcc640688385bd88ca3881828abb80157ecfa23fe7741a7f0c1a0c1674d31935979b34c43148e0014577a681aff4480ad62569ac485861189916c4d496ba2ac

    • SSDEEP

      3072:c5dhlySNGb4ndosyJhVbyLNLd7m4tJOyXSwl2vTyf2uV+r5y7ZwYWWvkpejxM:ZSNRndSIpLdC4t8yXzU7mQ0lxg

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks