General

  • Target

    Bonk_Desktop-2.5.1-win64.scr.exe

  • Size

    1.6MB

  • Sample

    230319-hsm8vsfc97

  • MD5

    d611f6db4e89addeec8353aa6bf1ba73

  • SHA1

    56ada47afb2425c56f0cb406f52bcefcfe99cc6a

  • SHA256

    cdc7fec4fe988cddbe0c2cc63610d2503c0205ff47ae7cad7f08ae36c3d84498

  • SHA512

    d22eb5dbe843f6d61d8e40218862c86418f6f1f9350f085169c358b18372f420807536b2d35dd14e969648fe540bfcbd6920b1df0a2f45a9770febbfd4fadf68

  • SSDEEP

    12288:ms5WXho3nTu7FOeBKpHmM7ShW0sJLAltXy6GkJROHRnz+y+W:55XeoHmNhW002tlG7D

Malware Config

Extracted

Family

redline

Botnet

11.03.BONK

C2

94.130.181.125:37659

Attributes
  • auth_value

    0bba02a10b2737292331dae660c844c0

Targets

    • Target

      Bonk_Desktop-2.5.1-win64.scr.exe

    • Size

      1.6MB

    • MD5

      d611f6db4e89addeec8353aa6bf1ba73

    • SHA1

      56ada47afb2425c56f0cb406f52bcefcfe99cc6a

    • SHA256

      cdc7fec4fe988cddbe0c2cc63610d2503c0205ff47ae7cad7f08ae36c3d84498

    • SHA512

      d22eb5dbe843f6d61d8e40218862c86418f6f1f9350f085169c358b18372f420807536b2d35dd14e969648fe540bfcbd6920b1df0a2f45a9770febbfd4fadf68

    • SSDEEP

      12288:ms5WXho3nTu7FOeBKpHmM7ShW0sJLAltXy6GkJROHRnz+y+W:55XeoHmNhW002tlG7D

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks