General

  • Target

    83da58121a0a4e3841e78f340eb3ce30e6453cd33a241267b0db1a330133904d

  • Size

    282KB

  • Sample

    230607-28scashe9z

  • MD5

    c9a874cc70ecf81a8993a2e191c21e00

  • SHA1

    583d0b1cf1cc3a99bbbff0adceb78dccc4173010

  • SHA256

    83da58121a0a4e3841e78f340eb3ce30e6453cd33a241267b0db1a330133904d

  • SHA512

    20e3a561656e899283fdbd0097a318c195ca2b6aff834f155e1e660a45614220b250bd1fb06704a6476d1cfc0ad3aaf1b9b9bb59973543b4c784272c7c14a576

  • SSDEEP

    6144:LQvoWvJaFUqwvTygXUNVS4MGh1aBFrvz1xcxcWhFrt:LU4IyR1aBFrvz1xcxdFrt

Malware Config

Extracted

Family

redline

Botnet

sheron

C2

83.97.73.129:19068

Attributes
  • auth_value

    2d067e7e2372227d3a03b335260112e9

Targets

    • Target

      83da58121a0a4e3841e78f340eb3ce30e6453cd33a241267b0db1a330133904d

    • Size

      282KB

    • MD5

      c9a874cc70ecf81a8993a2e191c21e00

    • SHA1

      583d0b1cf1cc3a99bbbff0adceb78dccc4173010

    • SHA256

      83da58121a0a4e3841e78f340eb3ce30e6453cd33a241267b0db1a330133904d

    • SHA512

      20e3a561656e899283fdbd0097a318c195ca2b6aff834f155e1e660a45614220b250bd1fb06704a6476d1cfc0ad3aaf1b9b9bb59973543b4c784272c7c14a576

    • SSDEEP

      6144:LQvoWvJaFUqwvTygXUNVS4MGh1aBFrvz1xcxcWhFrt:LU4IyR1aBFrvz1xcxdFrt

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks