General

  • Target

    f3433427.exe

  • Size

    262KB

  • Sample

    230703-e4hwqsfh8w

  • MD5

    6704525e46855fc500ed893dfad2dc14

  • SHA1

    23f3b3c10b01fe19ec274bf8b7768c0ed2de4563

  • SHA256

    8822b23397ab4b6df4c2f6b592a166c5e3b42777255b513d1cfafc88b77a1514

  • SHA512

    3077267f19c5a081ade7c679b258c208c5ea7f3b182529da768a0c5a68ae6de822c90dd645c40b49cdb33756c14d25a15a055dd171e37557d577655ed6a06323

  • SSDEEP

    3072:VaVM2x4qPDTyJhVbyLNLd7m4tJOyXSwl2vTyf2uV+r5y7ZwYWWv3pejxM:VaVMzqP2IpLdC4t8yXzU7mQ0lpD

Malware Config

Extracted

Family

redline

Botnet

andre

C2

77.91.124.49:19073

Attributes
  • auth_value

    8e5522dc6bdb7e288797bc46c2687b12

Targets

    • Target

      f3433427.exe

    • Size

      262KB

    • MD5

      6704525e46855fc500ed893dfad2dc14

    • SHA1

      23f3b3c10b01fe19ec274bf8b7768c0ed2de4563

    • SHA256

      8822b23397ab4b6df4c2f6b592a166c5e3b42777255b513d1cfafc88b77a1514

    • SHA512

      3077267f19c5a081ade7c679b258c208c5ea7f3b182529da768a0c5a68ae6de822c90dd645c40b49cdb33756c14d25a15a055dd171e37557d577655ed6a06323

    • SSDEEP

      3072:VaVM2x4qPDTyJhVbyLNLd7m4tJOyXSwl2vTyf2uV+r5y7ZwYWWv3pejxM:VaVMzqP2IpLdC4t8yXzU7mQ0lpD

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks