General

  • Target

    file.exe

  • Size

    350KB

  • Sample

    230703-xqxf3shf72

  • MD5

    364bca494e5a4dd172cf5308a0fdb54d

  • SHA1

    1fa70d02e42e0d1dd081bce9d4df5d9438cb64e5

  • SHA256

    eff8644c39234a7ea2402081ff0070cfbc1f1a8af910dd23df86f8941058f2d7

  • SHA512

    e40a2d4a66c189726609d881e5d4b44f4b947f9612ed238a236c81163252df8c5d32713a8b31ed49ef70876bb93ce011d99065884127ad8cd9d5468f77d31b74

  • SSDEEP

    6144:VRSN2uS+JQKElW2yGJm4myg1O/pg9VzNUF/:+N2uSkd2hmyg9g/

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

C2

146.59.161.7:48080

Attributes
  • auth_value

    c2955ed3813a798683a185a82e949f88

Targets

    • Target

      file.exe

    • Size

      350KB

    • MD5

      364bca494e5a4dd172cf5308a0fdb54d

    • SHA1

      1fa70d02e42e0d1dd081bce9d4df5d9438cb64e5

    • SHA256

      eff8644c39234a7ea2402081ff0070cfbc1f1a8af910dd23df86f8941058f2d7

    • SHA512

      e40a2d4a66c189726609d881e5d4b44f4b947f9612ed238a236c81163252df8c5d32713a8b31ed49ef70876bb93ce011d99065884127ad8cd9d5468f77d31b74

    • SSDEEP

      6144:VRSN2uS+JQKElW2yGJm4myg1O/pg9VzNUF/:+N2uSkd2hmyg9g/

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks