General

  • Target

    file.exe

  • Size

    340KB

  • Sample

    230703-hvxv3sge6x

  • MD5

    b1210337238ecdc153cd72e1d076a86f

  • SHA1

    de70116bf70765427779af32331f7b271fb7f044

  • SHA256

    5997ff949146afd38439ca2dae3bafd7e803d7b7050017cb5d0db5a201264d13

  • SHA512

    e72c5273f6add5cb835708a53fac02094244cca25e02ffcc16d1d252a1d755ebe6298e32eb97e5ff19b4fdbf5bf71c7d470b2d340e2e88e5fb97077ff5d20d0e

  • SSDEEP

    6144:1TS7frZKBUNYFVdVB7lz9TtJ0q/E+tPl:s7frZAFVdVB7lz9TtJNs+L

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

C2

146.59.161.7:48080

Attributes
  • auth_value

    c2955ed3813a798683a185a82e949f88

Targets

    • Target

      file.exe

    • Size

      340KB

    • MD5

      b1210337238ecdc153cd72e1d076a86f

    • SHA1

      de70116bf70765427779af32331f7b271fb7f044

    • SHA256

      5997ff949146afd38439ca2dae3bafd7e803d7b7050017cb5d0db5a201264d13

    • SHA512

      e72c5273f6add5cb835708a53fac02094244cca25e02ffcc16d1d252a1d755ebe6298e32eb97e5ff19b4fdbf5bf71c7d470b2d340e2e88e5fb97077ff5d20d0e

    • SSDEEP

      6144:1TS7frZKBUNYFVdVB7lz9TtJ0q/E+tPl:s7frZAFVdVB7lz9TtJNs+L

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks