General

  • Target

    bce20e1314106cda5084d49c6b222f1c4392ad2bdade1121c4f38bbc049b591d

  • Size

    282KB

  • Sample

    230607-1rz55sgd43

  • MD5

    df150b695a8515b32f1019fac5790700

  • SHA1

    a8873b7323517aaa6bd9a8096589ab79b2d7f3af

  • SHA256

    bce20e1314106cda5084d49c6b222f1c4392ad2bdade1121c4f38bbc049b591d

  • SHA512

    704927f304dbc959ed814bb642678903a229563702bf6d5aa64d5a5743c02e881517286a4aab8699d97f36f6eb712fd34e27c46a8b02eb4bd1cbc0431b59df3e

  • SSDEEP

    6144:tQvoWvJWOOewvTygXUNVS4MGh1aBFrvz1xcxcWhVrtn:tUFkyR1aBFrvz1xcxdVrtn

Malware Config

Extracted

Family

redline

Botnet

sheron

C2

83.97.73.129:19068

Attributes
  • auth_value

    2d067e7e2372227d3a03b335260112e9

Targets

    • Target

      bce20e1314106cda5084d49c6b222f1c4392ad2bdade1121c4f38bbc049b591d

    • Size

      282KB

    • MD5

      df150b695a8515b32f1019fac5790700

    • SHA1

      a8873b7323517aaa6bd9a8096589ab79b2d7f3af

    • SHA256

      bce20e1314106cda5084d49c6b222f1c4392ad2bdade1121c4f38bbc049b591d

    • SHA512

      704927f304dbc959ed814bb642678903a229563702bf6d5aa64d5a5743c02e881517286a4aab8699d97f36f6eb712fd34e27c46a8b02eb4bd1cbc0431b59df3e

    • SSDEEP

      6144:tQvoWvJWOOewvTygXUNVS4MGh1aBFrvz1xcxcWhVrtn:tUFkyR1aBFrvz1xcxdVrtn

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks