Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

TLP:WHITE18 IOCs

MetaStealer - Redline's Doppelgänger

RussianPanda

Published November 20, 2023Original Report

Threat Actors

Malware Families

Diamond Model

Adversary(1)

Infrastructure(3)

Capability(2)

Victim

Indicators of Compromise

Indicators of Compromise18

Type	Indicator	Confidence	Score	First Seen
SHA256	c2f2293ce2805f53ec80a5f9477dbb44af1bd403132450f8ea421a742e948494 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	4e6b8d28b175a2be89124a80e77753c9 file-hashintel-blogmalware	Medium	53	Oct 9, 26
URL	http://tempuri.org/Contract/MSValue1 intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	8502a5cbc33a50d5c38aaa5d82cd2dbf69deb80d4da6c73b2eee7a8cb26c2f71 file-hashintel-blogmalware	Medium	53	Oct 9, 26
Domain	crypter.guru intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	1ab93533bff654a20fd069d327ac4185620beb243135640c2213571c8902e325 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	5f690cddc7610b8d4aeb85b82979f326373674f9f4032ee214a65758f4e479be file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	2db8d58e51ddb3c04ff552ecc015de1297dc03a17ec7c2aed079ed476691c4aa file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	c90a887fc1013ea0b90522fa1f146b0b33d116763afb69ef260eb51b93cf8f46 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	65f76d89860101aa45eb3913044bd6c36c0639829f863a85f79b3294c1f4d7bb file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	727d823f0407659f3eb0c017e25023784a249d76c9e95a288b923abb4b2fe0dd file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	1a83b8555b2661726629b797758861727300d2ce95fe20279dec098011de1fff file-hashintel-blogmalware	Medium	53	Oct 9, 26
URL	http://tempuri.org/Entity/Id1.net intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	941cc18b46dd5240f03d438ff17f19d946a8037fbe765ae4bc35ffea280df976 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	ead3f92ffddf3eebb6b6d82958e811a0 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	78a04c5520cd25d9728becca1f032348b2432a3a803c6fed8b68a8ed8cca426f file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	de01e17676ce51e715c6fc116440c405ca4950392946a3aa3e19e28346239abb file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	19034212e12ba3c5087a21641121a70f9067a5621e5d03761e91aca63d20d993 file-hashintel-blogmalware	Medium	53	Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph18 total IOCs

SHA256MD5URLDomain

scroll to zoom · drag to pan · click IOC to open