General

  • Target

    bbbd26c921a45f4a809066b3480cac8dd3df27c7a699e4dda21019b60defe2a0

  • Size

    308KB

  • Sample

    230608-wdr56aab2s

  • MD5

    519f72a14ba3bf6fc65e803e647f1cbb

  • SHA1

    34667ce0b545368a74babe7959a86eabe8f45315

  • SHA256

    bbbd26c921a45f4a809066b3480cac8dd3df27c7a699e4dda21019b60defe2a0

  • SHA512

    6514b37b36549097985bf117687c07080aed2739dde4e554fb53b50ea7df0f487f924089cde098594a9e924e119c07718c8ad433e08d2400e2a2debb02598e1c

  • SSDEEP

    6144:JJieURFHHpMnTDs7UNVS49kCNQSzrs5kLJhHVugiqtciLRc1t/P:JJIR0D7NQSzrs5kLJhHVugiqtciLRy/P

Malware Config

Extracted

Family

redline

Botnet

crazy

C2

83.97.73.129:19068

Attributes
  • auth_value

    66bc4d9682ea090eef64a299ece12fdd

Targets

    • Target

      bbbd26c921a45f4a809066b3480cac8dd3df27c7a699e4dda21019b60defe2a0

    • Size

      308KB

    • MD5

      519f72a14ba3bf6fc65e803e647f1cbb

    • SHA1

      34667ce0b545368a74babe7959a86eabe8f45315

    • SHA256

      bbbd26c921a45f4a809066b3480cac8dd3df27c7a699e4dda21019b60defe2a0

    • SHA512

      6514b37b36549097985bf117687c07080aed2739dde4e554fb53b50ea7df0f487f924089cde098594a9e924e119c07718c8ad433e08d2400e2a2debb02598e1c

    • SSDEEP

      6144:JJieURFHHpMnTDs7UNVS49kCNQSzrs5kLJhHVugiqtciLRc1t/P:JJIR0D7NQSzrs5kLJhHVugiqtciLRy/P

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks