Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    929KB

  • Sample

    221123-qjx1pseb73

  • MD5

    ba95d1eb4a2e75a13058cf64aaaf747f

  • SHA1

    1d1890cfb6f45b4d1a690674a28e19446c5c33a9

  • SHA256

    a964be69ae3a3b5aa6b824909ea7d3a65e3b6230aba8d5199dfca82284029b72

  • SHA512

    a1855402c51ced0d752643640e654c37c3c52a69b81ebd9b1632d598a291ef2dbe410263787bf6a75569ab76bf8014b6a6c14f285df7df3e99bb969d09829e10

  • SSDEEP

    12288:9BA+gaChl8BfvNqMNRKmQewnhAeCWRnL/TbNS1nDwpOFLuSOE3lKFAvQlOTPp5kr:9LgBhmBfvNq1dnL/nA1UpOFuFAvHH

Score
10/10
redlinelogsdiller cloud (tg: @logsdillabot)infostealerspyware

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

213.32.44.120:6254

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Targets

    • Target

      file.exe

    • Size

      929KB

    • MD5

      ba95d1eb4a2e75a13058cf64aaaf747f

    • SHA1

      1d1890cfb6f45b4d1a690674a28e19446c5c33a9

    • SHA256

      a964be69ae3a3b5aa6b824909ea7d3a65e3b6230aba8d5199dfca82284029b72

    • SHA512

      a1855402c51ced0d752643640e654c37c3c52a69b81ebd9b1632d598a291ef2dbe410263787bf6a75569ab76bf8014b6a6c14f285df7df3e99bb969d09829e10

    • SSDEEP

      12288:9BA+gaChl8BfvNqMNRKmQewnhAeCWRnL/TbNS1nDwpOFLuSOE3lKFAvQlOTPp5kr:9LgBhmBfvNq1dnL/nA1UpOFuFAvHH

    Score
    10/10
    redlinelogsdiller cloud (tg: @logsdillabot)infostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Uses the VBS compiler for execution

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks