General

  • Target

    file.exe

  • Size

    342KB

  • Sample

    230528-ahq8rsde74

  • MD5

    21b385a7d4718bde937e24506d0bdbee

  • SHA1

    92e3c266d2c41ea94b7ca2acdf5d96953f323605

  • SHA256

    a4bb9762185f053519b66a792b63b2d207c8861facbfdb8b3d25b051367eed97

  • SHA512

    56eb617e381e5b06e9b62cf233d6c70517798d9653cef7565f00731fc810e8d3a93f4db92c4f22620bd58b8f821f912032db5ce43a508da004e73031461971f3

  • SSDEEP

    6144:FurvL0HW5pM23X13fFpXx9Malz6ZtatG+C2q:An025pM2nlfFBPlz6a4+J

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

C2

51.210.170.199:23368

Attributes
  • auth_value

    c2955ed3813a798683a185a82e949f88

Targets

    • Target

      file.exe

    • Size

      342KB

    • MD5

      21b385a7d4718bde937e24506d0bdbee

    • SHA1

      92e3c266d2c41ea94b7ca2acdf5d96953f323605

    • SHA256

      a4bb9762185f053519b66a792b63b2d207c8861facbfdb8b3d25b051367eed97

    • SHA512

      56eb617e381e5b06e9b62cf233d6c70517798d9653cef7565f00731fc810e8d3a93f4db92c4f22620bd58b8f821f912032db5ce43a508da004e73031461971f3

    • SSDEEP

      6144:FurvL0HW5pM23X13fFpXx9Malz6ZtatG+C2q:An025pM2nlfFBPlz6a4+J

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks