General

  • Target

    R B X 1 2 5.rar

  • Size

    9.7MB

  • Sample

    240815-ngx7ksthrl

  • MD5

    775d1f7409c0507d2864d7bd283ef914

  • SHA1

    fc28466f13da0f88cde02bd70b79e8a3f093c4e3

  • SHA256

    0bf30e9e9446bb909d3459669312f5982f6af0a3dd1d61eb141c386785b52331

  • SHA512

    f3e190834aca8fa56683148ce012622360fdc575eccb6a667021df6d92cd260a57689fc7b9ca3ff47bcbeac1f2f4a8679fb46228751e8756a6925f4018cf6573

  • SSDEEP

    196608:pzg44wZIYG1SyNmDfJjO8pMjHWXjBawNBxm2gMTHNV4Y/ry++jn5H9I:m5wZIL1TCEXjHwBawzxNnrG5j5G

Malware Config

Extracted

Family

redline

C2

185.196.9.26:6302

Targets

    • Target

      R B X 1 2 5.rar

    • Size

      9.7MB

    • MD5

      775d1f7409c0507d2864d7bd283ef914

    • SHA1

      fc28466f13da0f88cde02bd70b79e8a3f093c4e3

    • SHA256

      0bf30e9e9446bb909d3459669312f5982f6af0a3dd1d61eb141c386785b52331

    • SHA512

      f3e190834aca8fa56683148ce012622360fdc575eccb6a667021df6d92cd260a57689fc7b9ca3ff47bcbeac1f2f4a8679fb46228751e8756a6925f4018cf6573

    • SSDEEP

      196608:pzg44wZIYG1SyNmDfJjO8pMjHWXjBawNBxm2gMTHNV4Y/ry++jn5H9I:m5wZIL1TCEXjHwBawzxNnrG5j5G

    Score
    5/10
    • Drops file in System32 directory

    • Target

      R B X 1 2 5/Client.config

    • Size

      33.0MB

    • MD5

      157bca5bfbab154797fbbe947946084f

    • SHA1

      280096391abd2ea592198d205b6e44cdd2408121

    • SHA256

      f9aae2ca83d60ae3a6e443d23c91672cda766f73003e4f3f0f99eec1f336d946

    • SHA512

      5fbbaa59d4425779ecae554372a476414a60b70fe190ca408a0505b13064866d1576e6409e657d2933cd5922a053aacdf7c01b457b3385476dabfe1c46b5c1da

    • SSDEEP

      786432:BeCve2OlHAoFfgrh96BKMZvBx9ImCrWFi6:BejjlHAopI9xABx9ErWFi6

    Score
    3/10
    • Target

      R B X 1 2 5/Roblox Executor.exe

    • Size

      610KB

    • MD5

      2744b07299dfa1999cff269ea72a2b80

    • SHA1

      8f1527af2b2b9f0134d834ab959902ac99b9783f

    • SHA256

      91791c26f8831977e9d0b64d25e4e699b6b4e8360377ce3bfec803c5683470ce

    • SHA512

      724d7154965865a626b5369afff7d911198d9d9bef728cde2680a0f09565520b69044d21bf063bce5246b52bdad5c46636dd1c1b73a1e0183272a9c1f27be3ab

    • SSDEEP

      12288:s/4LI3Kvjc6xh0J5P4bEPcL9XTWMsmNkBFV2KpkL9nI9rNtFamI3v6WZDtWdD+A5:4B3P6IR4bEPU

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

    • Target

      R B X 1 2 5/ai.cfg

    • Size

      44B

    • MD5

      73ed0e22c8cc70ed93dfd0c1b8f81e19

    • SHA1

      f16c87ca3eb393ee34f57fb59781cd37f5963db0

    • SHA256

      db9ec7ae21d140904d44d6e6550c0c964e32ef11c055696b355835905c9c3a53

    • SHA512

      3dbe1fd660c7446c4a70c99cf6bf7909c76cd02ca24930bdeee851da094850b2fd6f6742025d215ce7dbf3348225c0b64d28e3f1ba133bdd9c7beece84d7e54f

    Score
    3/10
    • Target

      R B X 1 2 5/cacert.pem

    • Size

      2KB

    • MD5

      39f89143815797c4a41c62f30f137094

    • SHA1

      39a602c37ee958e5a5779c167ea095a56f0218e4

    • SHA256

      5513aa54afe134569e08b27aa61e60e888ab31d9e112f8c5881adbaecc817678

    • SHA512

      02cfee4a3fdc728e63e5a63797c58c5a6fbd805f6f6e5c0ab4e5dbf1d1701636a6aefc94095096b627b7475e731327d620c519ddc1a65b3ee49dd41b4d219d6d

    Score
    3/10
    • Target

      R B X 1 2 5/config.vdf

    • Size

      14KB

    • MD5

      bb23e26ed15c9951460513efdb0b7ac7

    • SHA1

      41e15b1f30840160ea095f0f415ac3afd6d06968

    • SHA256

      9fce8b4ac41455418615f2785199f72d7fe6ce39d8cd9182027a752c4f26d04a

    • SHA512

      f3f3e7ef4765520554fcb523b43f448b28b29fbbf150657728084b720fca4568a23a3846f37f3c57b6710fdeb3761fecc190f468944ba1a687aad0e8f7af1093

    • SSDEEP

      96:o9lCt/5KFdRBQ20LPr7U8Op3y47Zu/ZqaJOTFogkU:o9MtBKFdRBQ20LPr7U8OBlsRq8gkU

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks