General

  • Target

    22f21cab8faaf507af3df4e5f89c49ce.exe

  • Size

    274KB

  • Sample

    230712-v3jpmsfb7y

  • MD5

    22f21cab8faaf507af3df4e5f89c49ce

  • SHA1

    118afe10b1e37c66ee3f43fd52bc66b0cb1c3b7b

  • SHA256

    ced82fc8536367273376587185cae84da28d288895fc03f829ef7bf53d0bede9

  • SHA512

    bd1cde2b8a1d8e3949b70e3024aec53b0fe3a1813e864e704bef5796e78ed037d2a1ce203165eda44928108160fc7ee2b84474a0a631ac00579495b956f26eb5

  • SSDEEP

    3072:vy2mhTxV3CKabe+uRbvJ9J3HgIuhe6jM5vUbUHrIRqqBj+oW4ZLWJ5H1JRuZrRe2:q/ZzC+3HgIus6Y5JHER1Bj+oW4SRuZv

Malware Config

Extracted

Family

redline

Botnet

@hunktv0_0

C2

vikaneleneer.shop:80

Attributes
  • auth_value

    bc3d2757a75536c9fcd2ccb36e854270

Targets

    • Target

      22f21cab8faaf507af3df4e5f89c49ce.exe

    • Size

      274KB

    • MD5

      22f21cab8faaf507af3df4e5f89c49ce

    • SHA1

      118afe10b1e37c66ee3f43fd52bc66b0cb1c3b7b

    • SHA256

      ced82fc8536367273376587185cae84da28d288895fc03f829ef7bf53d0bede9

    • SHA512

      bd1cde2b8a1d8e3949b70e3024aec53b0fe3a1813e864e704bef5796e78ed037d2a1ce203165eda44928108160fc7ee2b84474a0a631ac00579495b956f26eb5

    • SSDEEP

      3072:vy2mhTxV3CKabe+uRbvJ9J3HgIuhe6jM5vUbUHrIRqqBj+oW4ZLWJ5H1JRuZrRe2:q/ZzC+3HgIus6Y5JHER1Bj+oW4SRuZv

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks