General

  • Target

    88b90ce5a324fa59bbf3d584e37cd23edb218158f1fa7ac158fce1016c5f1d81

  • Size

    282KB

  • Sample

    230608-fmznlach2x

  • MD5

    1bf27073c19cd9144004862515d1cc89

  • SHA1

    658563b0a5c33409bd3fecc0984962a4d3df4629

  • SHA256

    88b90ce5a324fa59bbf3d584e37cd23edb218158f1fa7ac158fce1016c5f1d81

  • SHA512

    0f1cf9dbdd7542ae674f7cd628137d3bc0d06ec2b8af778f667962daf1bfbbb391dfd751176911d49ac71f608bfd9995efebaaa321d1b819b9a198d6a9e5ac40

  • SSDEEP

    6144:0QvoWvJHv8+wvTygXUNVS4MGh1aBFrvz1xcxcWhOrt:0U1YyR1aBFrvz1xcxdOrt

Malware Config

Extracted

Family

redline

Botnet

sheron

C2

83.97.73.129:19068

Attributes
  • auth_value

    2d067e7e2372227d3a03b335260112e9

Targets

    • Target

      88b90ce5a324fa59bbf3d584e37cd23edb218158f1fa7ac158fce1016c5f1d81

    • Size

      282KB

    • MD5

      1bf27073c19cd9144004862515d1cc89

    • SHA1

      658563b0a5c33409bd3fecc0984962a4d3df4629

    • SHA256

      88b90ce5a324fa59bbf3d584e37cd23edb218158f1fa7ac158fce1016c5f1d81

    • SHA512

      0f1cf9dbdd7542ae674f7cd628137d3bc0d06ec2b8af778f667962daf1bfbbb391dfd751176911d49ac71f608bfd9995efebaaa321d1b819b9a198d6a9e5ac40

    • SSDEEP

      6144:0QvoWvJHv8+wvTygXUNVS4MGh1aBFrvz1xcxcWhOrt:0U1YyR1aBFrvz1xcxdOrt

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks