General

  • Target

    84e27fcba8dafad9adaa017152ce08c8762daffc2a8e040c7bbd6d3f441f98cc

  • Size

    282KB

  • Sample

    230607-1dvy9sgb64

  • MD5

    64e3bad98059a4d2d43e3d570d4f7ff2

  • SHA1

    15a014bd2b357ebbbecaddad5561595aeda1bb3e

  • SHA256

    84e27fcba8dafad9adaa017152ce08c8762daffc2a8e040c7bbd6d3f441f98cc

  • SHA512

    777ac1bb7a025383085bfc9dcee18c926063a8a4ca4de653f05b82c55a8368f0952a21fcc86252e49642221080a486adf2f6d0c6f2a991b940b98588350b75c1

  • SSDEEP

    6144:wQvoWvJfu1ywvTygXUNVS4MGh1aBFrvz1xcxcWhOrt:wU4XyR1aBFrvz1xcxdOrt

Malware Config

Extracted

Family

redline

Botnet

sheron

C2

83.97.73.129:19068

Attributes
  • auth_value

    2d067e7e2372227d3a03b335260112e9

Targets

    • Target

      84e27fcba8dafad9adaa017152ce08c8762daffc2a8e040c7bbd6d3f441f98cc

    • Size

      282KB

    • MD5

      64e3bad98059a4d2d43e3d570d4f7ff2

    • SHA1

      15a014bd2b357ebbbecaddad5561595aeda1bb3e

    • SHA256

      84e27fcba8dafad9adaa017152ce08c8762daffc2a8e040c7bbd6d3f441f98cc

    • SHA512

      777ac1bb7a025383085bfc9dcee18c926063a8a4ca4de653f05b82c55a8368f0952a21fcc86252e49642221080a486adf2f6d0c6f2a991b940b98588350b75c1

    • SSDEEP

      6144:wQvoWvJfu1ywvTygXUNVS4MGh1aBFrvz1xcxcWhOrt:wU4XyR1aBFrvz1xcxdOrt

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks