General

  • Target

    230cb9aaa3f33ea00cd3478c9433e401e4b0ac2a5916bbf10d85a3a48f6b8d58

  • Size

    282KB

  • Sample

    230608-cdy4xsbb6z

  • MD5

    3a0f25daf5e086b6561e2e7fc66cc84b

  • SHA1

    7951ab75b18949ea5454ba48ca9ab7a467c09d66

  • SHA256

    230cb9aaa3f33ea00cd3478c9433e401e4b0ac2a5916bbf10d85a3a48f6b8d58

  • SHA512

    2b5333f6900a18f5653a3bdeca22085717214fe4bb25a1734469cb396a1bec3d94833092bf4c84840d4a48d1fb55fd387676d37a47a10d65961c600f56114a05

  • SSDEEP

    6144:DQvoWvJE3mPwvTygXUNVS4MGh1aBFrvz1xcxcWhart:DUmVyR1aBFrvz1xcxdart

Malware Config

Extracted

Family

redline

Botnet

sheron

C2

83.97.73.129:19068

Attributes
  • auth_value

    2d067e7e2372227d3a03b335260112e9

Targets

    • Target

      230cb9aaa3f33ea00cd3478c9433e401e4b0ac2a5916bbf10d85a3a48f6b8d58

    • Size

      282KB

    • MD5

      3a0f25daf5e086b6561e2e7fc66cc84b

    • SHA1

      7951ab75b18949ea5454ba48ca9ab7a467c09d66

    • SHA256

      230cb9aaa3f33ea00cd3478c9433e401e4b0ac2a5916bbf10d85a3a48f6b8d58

    • SHA512

      2b5333f6900a18f5653a3bdeca22085717214fe4bb25a1734469cb396a1bec3d94833092bf4c84840d4a48d1fb55fd387676d37a47a10d65961c600f56114a05

    • SSDEEP

      6144:DQvoWvJE3mPwvTygXUNVS4MGh1aBFrvz1xcxcWhart:DUmVyR1aBFrvz1xcxdart

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks