redline | bbc18dde3ed21e51e97e0187f63a2b8787ef3be6c3070e915497c66bfc179187 | Triage

Sharing

General

Target

520-94-0x0000000000230000-0x0000000000BA2000-memory.dmp
Size

9.4MB
Sample

230328-smjctsdd3x
MD5

e1e56585152a2dcb581105339d0ee454
SHA1

f402d6b874273d99aef0b6db1f49ed12538fea28
SHA256

bbc18dde3ed21e51e97e0187f63a2b8787ef3be6c3070e915497c66bfc179187
SHA512

1189ad59a3cdbb258f1e73b8c4369502300c3646171fde7fe90dbeb2436a49ddda99fd1d5c39732705a97811f0e6353fcf475626f32cbb70768fa2602cdaac43
SSDEEP

196608:2QQZN6NLt86pyG1YYR3oSzi6jPdvHa7ZO4N9/YsYWVvT3q:2qNLfS0iSZyFN9gsPb3q

Score

10^/10

redline logsdiller cloud (telegram: @logsdillabot)discovery infostealer spyware stealer themida

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

C2

51.210.161.21:36108

Attributes

auth_value
c2955ed3813a798683a185a82e949f88

Targets

- Target
  
  520-94-0x0000000000230000-0x0000000000BA2000-memory.dmp
- Size
  
  9.4MB
- MD5
  
  e1e56585152a2dcb581105339d0ee454
- SHA1
  
  f402d6b874273d99aef0b6db1f49ed12538fea28
- SHA256
  
  bbc18dde3ed21e51e97e0187f63a2b8787ef3be6c3070e915497c66bfc179187
- SHA512
  
  1189ad59a3cdbb258f1e73b8c4369502300c3646171fde7fe90dbeb2436a49ddda99fd1d5c39732705a97811f0e6353fcf475626f32cbb70768fa2602cdaac43
- SSDEEP
  
  196608:2QQZN6NLt86pyG1YYR3oSzi6jPdvHa7ZO4N9/YsYWVvT3q:2qNLfS0iSZyFN9gsPb3q
Score

10^/10

redline logsdiller cloud (telegram: @logsdillabot)discovery infostealer spyware stealer themida
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

themidalogsdiller cloud (telegram: @logsdillabot)redline

behavioral1

behavioral2

redlinelogsdiller cloud (telegram: @logsdillabot)discoveryinfostealerspywarestealerthemida