General

  • Target

    file.exe

  • Size

    1.3MB

  • Sample

    230203-q7518afe97

  • MD5

    86221cbb7f0dd696acfc913ad055f1e9

  • SHA1

    52aceb9f15f0ebceef27b378e06e42613739b481

  • SHA256

    ebb2dcf0d743e210a391d665b4589e3a0e41189ed1b21fcacc8c14caf13b1ce6

  • SHA512

    cdeb09240ef04ac7d5b50cd03f7479e8fa40407a34d41c780350acbaeaf4d18dc9381a4cb276ca700595a3d6a5c0abb4fa987f22bfc220d39dc4c91312c8e6d9

  • SSDEEP

    24576:g+JA0Sg9WLT0Fo2/JJTBQ0g1A9K9rjF/lQkBNnWZrXBkUGlcUDSg1fcjzajdg8MC:XJJ92wZXgu49rjF/+kBNmxZG5DSg10j/

Malware Config

Extracted

Family

redline

Botnet

TORRENTOLD

C2

amrican-sport-live-stream.cc:4581

Attributes
  • auth_value

    74e1b58bf920611f04c0e3919954fe05

Targets

    • Target

      file.exe

    • Size

      1.3MB

    • MD5

      86221cbb7f0dd696acfc913ad055f1e9

    • SHA1

      52aceb9f15f0ebceef27b378e06e42613739b481

    • SHA256

      ebb2dcf0d743e210a391d665b4589e3a0e41189ed1b21fcacc8c14caf13b1ce6

    • SHA512

      cdeb09240ef04ac7d5b50cd03f7479e8fa40407a34d41c780350acbaeaf4d18dc9381a4cb276ca700595a3d6a5c0abb4fa987f22bfc220d39dc4c91312c8e6d9

    • SSDEEP

      24576:g+JA0Sg9WLT0Fo2/JJTBQ0g1A9K9rjF/lQkBNnWZrXBkUGlcUDSg1fcjzajdg8MC:XJJ92wZXgu49rjF/+kBNmxZG5DSg10j/

    • Detect PureCrypter injector

    • PureCrypter

      PureCrypter is a .NET malware loader first seen in early 2021.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Tasks