General

  • Target

    https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbGlaY3Q2bFVpVVpZWlVpa3lRanowX3R0a3Rod3xBQ3Jtc0tuYk5jU2VUTFdCVGxZZjVjMUp0MXNVdG5FUGwzQkxzVUNDV1ZVVjNzRTF2OVcwaGlKQnVPLTc3M2Ruemd0QzRwRUJ6by1tVE1kZGdWdDN1bXRYTW8zRktoSlBIelczQW9ZNzc4Z25hSngxSDMxWVRMWQ&q=https%3A%2F%2Flavacheat.com%2Fcheat%2Fsot-5040&v=0YO5nVTPCmA

  • Sample

    230402-l9l9nsfg83

Malware Config

Extracted

Family

redline

Botnet

Scarflog

C2

135.181.49.56:17248

Attributes
  • auth_value

    01eab890df4b5da430be4638d836c22f

Targets

    • Target

      https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbGlaY3Q2bFVpVVpZWlVpa3lRanowX3R0a3Rod3xBQ3Jtc0tuYk5jU2VUTFdCVGxZZjVjMUp0MXNVdG5FUGwzQkxzVUNDV1ZVVjNzRTF2OVcwaGlKQnVPLTc3M2Ruemd0QzRwRUJ6by1tVE1kZGdWdDN1bXRYTW8zRktoSlBIelczQW9ZNzc4Z25hSngxSDMxWVRMWQ&q=https%3A%2F%2Flavacheat.com%2Fcheat%2Fsot-5040&v=0YO5nVTPCmA

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks