Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
18 IOCs

MetaStealer - Redline's Doppelgänger

RussianPanda
RussianPanda
Published November 20, 2023Original Report

Threat Actors

Malware Families

Excerpt

Case Study MetaStealer made its debut on Russian hacking forums on March 7, 2022. The stealer is said to incorporate the functionality, code, and panel of Redline Stealer. The developer claims to have improved the stub of the payload. It is priced at $150 per month, mirroring the price of Redline Stealer. Note: Some samples of MetaStealer have been found in sandbox platforms like Triage, Joe Sandbox, Any.run and classified as Redline or “another” MetaStealer” that appears to…

Read the original report →

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYSandwormINFRASTRUCTUREhttp://tempuri.org/Co…crypter.guruhttp://tempuri.org/En…CAPABILITYMETA StealerRedLineVICTIMunknown
Adversary(1)
Infrastructure(3)
Capability(2)
Victim

Indicators of Compromise

Open the mindmap →

18 indicators

TypeIndicatorConfidenceScoreFirst Seen
SHA256c2f2293ce2805f53ec80a5f9477dbb44af1bd403132450f8ea421a742e948494MediumScore 53/100First seen
MD54e6b8d28b175a2be89124a80e77753c9MediumScore 53/100First seen
URLhttp://tempuri.org/Contract/MSValue1HighScore 58/100First seen
SHA2568502a5cbc33a50d5c38aaa5d82cd2dbf69deb80d4da6c73b2eee7a8cb26c2f71MediumScore 53/100First seen
Domaincrypter.guruHighScore 58/100First seen
SHA2561ab93533bff654a20fd069d327ac4185620beb243135640c2213571c8902e325MediumScore 53/100First seen
SHA2565f690cddc7610b8d4aeb85b82979f326373674f9f4032ee214a65758f4e479beMediumScore 53/100First seen
SHA2562db8d58e51ddb3c04ff552ecc015de1297dc03a17ec7c2aed079ed476691c4aaMediumScore 53/100First seen
SHA256c90a887fc1013ea0b90522fa1f146b0b33d116763afb69ef260eb51b93cf8f46MediumScore 53/100First seen
SHA25665f76d89860101aa45eb3913044bd6c36c0639829f863a85f79b3294c1f4d7bbMediumScore 53/100First seen
SHA256727d823f0407659f3eb0c017e25023784a249d76c9e95a288b923abb4b2fe0ddMediumScore 53/100First seen
SHA2561a83b8555b2661726629b797758861727300d2ce95fe20279dec098011de1fffMediumScore 53/100First seen
URLhttp://tempuri.org/Entity/Id1.netHighScore 58/100First seen
SHA256941cc18b46dd5240f03d438ff17f19d946a8037fbe765ae4bc35ffea280df976MediumScore 53/100First seen
MD5ead3f92ffddf3eebb6b6d82958e811a0MediumScore 53/100First seen
SHA25678a04c5520cd25d9728becca1f032348b2432a3a803c6fed8b68a8ed8cca426fMediumScore 53/100First seen
SHA256de01e17676ce51e715c6fc116440c405ca4950392946a3aa3e19e28346239abbMediumScore 53/100First seen
SHA25619034212e12ba3c5087a21641121a70f9067a5621e5d03761e91aca63d20d993MediumScore 53/100First seen

IOC Relationship Graph

Building graph…