Resubmissions

22-05-2024 00:10

240522-af3h1sed73 10

22-05-2024 00:06

240522-ad1xeaed36 3

General

  • Target

    file

  • Size

    176KB

  • Sample

    240522-af3h1sed73

  • MD5

    b953eba523e77f6e19ec7a66e5babbad

  • SHA1

    82dbe8304fa22decf94b5a96e5a19697fcbf57ec

  • SHA256

    40a7b25cbc35c77604ac44d96e3cded8b29f3b5dd25c093550ae0629c7019ab1

  • SHA512

    f4be970955f40caebb4c57612ba3ed3b1d6b921ad1561189483ae8072b375868b2e25bc9189e802e28f42be360b3979d322f79e6a80dcff87a3073fdb7897652

  • SSDEEP

    1536:UijCa50ZoTgAJuHnjde83Ml83Mn1CyKBKyf6C9XS6zmFMtMd5/an/xlCv1aszFek:UiLgAkHnjPIQ6KSEX/+HuI4MU4

Malware Config

Extracted

Family

redline

Botnet

@fgkyleoff

C2

147.45.47.93:80

Targets

    • Target

      file

    • Size

      176KB

    • MD5

      b953eba523e77f6e19ec7a66e5babbad

    • SHA1

      82dbe8304fa22decf94b5a96e5a19697fcbf57ec

    • SHA256

      40a7b25cbc35c77604ac44d96e3cded8b29f3b5dd25c093550ae0629c7019ab1

    • SHA512

      f4be970955f40caebb4c57612ba3ed3b1d6b921ad1561189483ae8072b375868b2e25bc9189e802e28f42be360b3979d322f79e6a80dcff87a3073fdb7897652

    • SSDEEP

      1536:UijCa50ZoTgAJuHnjde83Ml83Mn1CyKBKyf6C9XS6zmFMtMd5/an/xlCv1aszFek:UiLgAkHnjPIQ6KSEX/+HuI4MU4

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks