General

  • Target

    7505d9832ff85469c8fc0610c220438f87c2e4a03a0aee3295e7eb22574ae395

  • Size

    309KB

  • Sample

    230608-n62lasfb29

  • MD5

    1ac96a2f4ca3ea104c6fb864471222b3

  • SHA1

    bae2e4dc9609ca2e1381914c5efb6ab3116bb833

  • SHA256

    7505d9832ff85469c8fc0610c220438f87c2e4a03a0aee3295e7eb22574ae395

  • SHA512

    efdefe7a51586c7bd33db664f7d783fddef678acd0b9e6e10937df8739544deefdd5d77536adfb05b8d0233f6a611b09151fdef7c212b6abe015b7288f869b58

  • SSDEEP

    6144:eD5k3As3xWy6FVdwvTygXUNVS4MGh1aBFrvz1xcxc730:eD2ky6KyR1aBFrvz1xcx60

Malware Config

Extracted

Family

redline

Botnet

sheron

C2

83.97.73.129:19068

Attributes
  • auth_value

    2d067e7e2372227d3a03b335260112e9

Targets

    • Target

      7505d9832ff85469c8fc0610c220438f87c2e4a03a0aee3295e7eb22574ae395

    • Size

      309KB

    • MD5

      1ac96a2f4ca3ea104c6fb864471222b3

    • SHA1

      bae2e4dc9609ca2e1381914c5efb6ab3116bb833

    • SHA256

      7505d9832ff85469c8fc0610c220438f87c2e4a03a0aee3295e7eb22574ae395

    • SHA512

      efdefe7a51586c7bd33db664f7d783fddef678acd0b9e6e10937df8739544deefdd5d77536adfb05b8d0233f6a611b09151fdef7c212b6abe015b7288f869b58

    • SSDEEP

      6144:eD5k3As3xWy6FVdwvTygXUNVS4MGh1aBFrvz1xcxc730:eD2ky6KyR1aBFrvz1xcx60

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks