General

  • Target

    6653f1bc33061b1bce896be92a108407e1694b9c90ca8b586818193654d58aac

  • Size

    262KB

  • Sample

    230607-wdyb6sdg95

  • MD5

    68faa9e7672fe38372ecf854d891dfba

  • SHA1

    915f1806ea8407e73437bb86eaf314764df561c4

  • SHA256

    6653f1bc33061b1bce896be92a108407e1694b9c90ca8b586818193654d58aac

  • SHA512

    18ae5ee5d74cbafef8cb2a0a10c53cd3753ee29037a5335072bbeada89cd7dcb207044573368d5882017801a067999174b3cd2d37055ee0f5c9204c889a3f5c7

  • SSDEEP

    3072:px/n1d+yGyXFaQ7RQ05CTEezbClXv8r8+oFe6gobFHFzA+E+2SUHcj/:n/n1F/FaQ7W05AEezbMPZFzAy2Sc

Malware Config

Extracted

Family

redline

Botnet

sheron

C2

83.97.73.129:19068

Attributes
  • auth_value

    2d067e7e2372227d3a03b335260112e9

Targets

    • Target

      6653f1bc33061b1bce896be92a108407e1694b9c90ca8b586818193654d58aac

    • Size

      262KB

    • MD5

      68faa9e7672fe38372ecf854d891dfba

    • SHA1

      915f1806ea8407e73437bb86eaf314764df561c4

    • SHA256

      6653f1bc33061b1bce896be92a108407e1694b9c90ca8b586818193654d58aac

    • SHA512

      18ae5ee5d74cbafef8cb2a0a10c53cd3753ee29037a5335072bbeada89cd7dcb207044573368d5882017801a067999174b3cd2d37055ee0f5c9204c889a3f5c7

    • SSDEEP

      3072:px/n1d+yGyXFaQ7RQ05CTEezbClXv8r8+oFe6gobFHFzA+E+2SUHcj/:n/n1F/FaQ7W05AEezbMPZFzAy2Sc

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks