General

  • Target

    990c3edaeb9069f598114443654563a5906f1529d7ae91a8ce95fff8fb3c4b37

  • Size

    309KB

  • Sample

    230608-makggaef8x

  • MD5

    9d6df3da913dab5ba6922f678d893229

  • SHA1

    53a75a5d933a810d707a48cc939ee3bc4d332cda

  • SHA256

    990c3edaeb9069f598114443654563a5906f1529d7ae91a8ce95fff8fb3c4b37

  • SHA512

    abaa4c341d1754db4cf24abb5cb498af239abef381891b52907056694c8511838a5e8601bb632fae46fb9bad60d80bdaaff6ec2ea18bed772a3e36b81d513fbf

  • SSDEEP

    6144:AD5k3As3x2y6FlcMwvTygXUNVS4MGh1aBFrvz1xcxc7b0:AD2Ey3zyR1aBFrvz1xcxG0

Malware Config

Extracted

Family

redline

Botnet

sheron

C2

83.97.73.129:19068

Attributes
  • auth_value

    2d067e7e2372227d3a03b335260112e9

Targets

    • Target

      990c3edaeb9069f598114443654563a5906f1529d7ae91a8ce95fff8fb3c4b37

    • Size

      309KB

    • MD5

      9d6df3da913dab5ba6922f678d893229

    • SHA1

      53a75a5d933a810d707a48cc939ee3bc4d332cda

    • SHA256

      990c3edaeb9069f598114443654563a5906f1529d7ae91a8ce95fff8fb3c4b37

    • SHA512

      abaa4c341d1754db4cf24abb5cb498af239abef381891b52907056694c8511838a5e8601bb632fae46fb9bad60d80bdaaff6ec2ea18bed772a3e36b81d513fbf

    • SSDEEP

      6144:AD5k3As3x2y6FlcMwvTygXUNVS4MGh1aBFrvz1xcxc7b0:AD2Ey3zyR1aBFrvz1xcxG0

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks