General

  • Target

    3285d0a1bca3e6f7f4fc483bc935c3ecd835dd7edb880372a395dfb66178b86f

  • Size

    261KB

  • Sample

    230607-rhqexabe39

  • MD5

    c8d986dc67fd5fd3bd5ec940978345d3

  • SHA1

    b4b3ddeaca861ddfceed3ee92206263f6a1e6ec9

  • SHA256

    3285d0a1bca3e6f7f4fc483bc935c3ecd835dd7edb880372a395dfb66178b86f

  • SHA512

    8597221d3d0773b0693d76613313f1a58fa7a1484f38abef6ee510f9a08ca3cbe250098feb5e82a787f773dfd9e35726ed9fe98ecdad57af81f37781a0bff7db

  • SSDEEP

    3072:Lhg741X6OiRyHFaQ7RQ05CTEezbClXv8r8+oFe6gobFHFzA+E+2yQHcj/:dgU1XTFaQ7W05AEezbMPZFzAy2yA

Malware Config

Extracted

Family

redline

Botnet

sheron

C2

83.97.73.129:19068

Attributes
  • auth_value

    2d067e7e2372227d3a03b335260112e9

Targets

    • Target

      3285d0a1bca3e6f7f4fc483bc935c3ecd835dd7edb880372a395dfb66178b86f

    • Size

      261KB

    • MD5

      c8d986dc67fd5fd3bd5ec940978345d3

    • SHA1

      b4b3ddeaca861ddfceed3ee92206263f6a1e6ec9

    • SHA256

      3285d0a1bca3e6f7f4fc483bc935c3ecd835dd7edb880372a395dfb66178b86f

    • SHA512

      8597221d3d0773b0693d76613313f1a58fa7a1484f38abef6ee510f9a08ca3cbe250098feb5e82a787f773dfd9e35726ed9fe98ecdad57af81f37781a0bff7db

    • SSDEEP

      3072:Lhg741X6OiRyHFaQ7RQ05CTEezbClXv8r8+oFe6gobFHFzA+E+2yQHcj/:dgU1XTFaQ7W05AEezbMPZFzAy2yA

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks