General

  • Target

    d6f691388f5ab04f0d6e6581022cfb9433b19dbf898242aead01e018390c52d0

  • Size

    267KB

  • Sample

    230824-d59v6shg66

  • MD5

    05c23209f0cb9f7204bf86eb0c46fe8d

  • SHA1

    7afa6dc940f4cae520504f97f230fbf49c5ba6be

  • SHA256

    d6f691388f5ab04f0d6e6581022cfb9433b19dbf898242aead01e018390c52d0

  • SHA512

    1abd98b7025dea1b57ec5f0b09e3c39a393e2c83018c7133ee362e98ca341a04a860bd9a0feb8a66b0ee4c32f0250c71b2f4ae5da9eb0fbaf30f69d15a4b1daf

  • SSDEEP

    6144:3e+D231Iu7jlZ9I3csB4I3BaNRVlN+2VCZhImLFq7J1JsMJs:3DDC1dwDQzs

Malware Config

Extracted

Family

redline

Botnet

lux3

C2

176.123.9.142:14845

Attributes
  • auth_value

    e94dff9a76da90d6b000642c4a52574b

Targets

    • Target

      d6f691388f5ab04f0d6e6581022cfb9433b19dbf898242aead01e018390c52d0

    • Size

      267KB

    • MD5

      05c23209f0cb9f7204bf86eb0c46fe8d

    • SHA1

      7afa6dc940f4cae520504f97f230fbf49c5ba6be

    • SHA256

      d6f691388f5ab04f0d6e6581022cfb9433b19dbf898242aead01e018390c52d0

    • SHA512

      1abd98b7025dea1b57ec5f0b09e3c39a393e2c83018c7133ee362e98ca341a04a860bd9a0feb8a66b0ee4c32f0250c71b2f4ae5da9eb0fbaf30f69d15a4b1daf

    • SSDEEP

      6144:3e+D231Iu7jlZ9I3csB4I3BaNRVlN+2VCZhImLFq7J1JsMJs:3DDC1dwDQzs

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

MITRE ATT&CK Enterprise v15

Tasks