General

  • Target

    tmp

  • Size

    1.3MB

  • Sample

    230328-f44c4sah7s

  • MD5

    7b36da4da4db96852a59a1a428554a55

  • SHA1

    9b5d0528b3f85f54f5aae5305a9f602e0a4ae834

  • SHA256

    dce05561ae5582a0a5e716dcd273ed4b9359eb5a2fb556d103c63dc75f03622e

  • SHA512

    828634d3b27f246ed0988a397cead98c0bd6e9023525e0069cb8e57581d53e7066bc92998c6f8d76c4713b79de8f35ffb28323b5dfec0e0f6fa304217738d5cf

  • SSDEEP

    24576:R+DS4BrH+eG0G+dqeUh80qIMt6RvXWpBtnZ6Nk3:R+DS4BqeI+drIzRPmBtZyk

Malware Config

Extracted

Family

redline

Botnet

HEXO-SOFTWARE

C2

amrican-sport-live-stream.cc:4581

Attributes
  • auth_value

    fea440ffae02b6f56d7b00fe8105ccb8

Targets

    • Target

      tmp

    • Size

      1.3MB

    • MD5

      7b36da4da4db96852a59a1a428554a55

    • SHA1

      9b5d0528b3f85f54f5aae5305a9f602e0a4ae834

    • SHA256

      dce05561ae5582a0a5e716dcd273ed4b9359eb5a2fb556d103c63dc75f03622e

    • SHA512

      828634d3b27f246ed0988a397cead98c0bd6e9023525e0069cb8e57581d53e7066bc92998c6f8d76c4713b79de8f35ffb28323b5dfec0e0f6fa304217738d5cf

    • SSDEEP

      24576:R+DS4BrH+eG0G+dqeUh80qIMt6RvXWpBtnZ6Nk3:R+DS4BqeI+drIzRPmBtZyk

    • Detect PureCrypter injector

    • PureCrypter

      PureCrypter is a .NET malware loader first seen in early 2021.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Tasks