General

  • Target

    file.exe

  • Size

    332KB

  • Sample

    230708-fjjg7sdg8s

  • MD5

    5e34921c1f635adc7977337b8cc28cd3

  • SHA1

    a4dd623c537b857698da72725d928e093b823bb5

  • SHA256

    0053d1419ec04041f1603063f4e7c0a6a370025de08a0bb69897cd6c757f1bb0

  • SHA512

    ef1b90dcbf73b5d8ef37b3c7baf30e228f151e66d5a7cf5028808976ef7bb2ff6fb1c82de8399480de1ca2780dcc082106efdf0ffa6418414c04faa4ad56ebda

  • SSDEEP

    3072:f8m6Y5tuh3wZD+SgX+9MBwAhy037ZnvOJbZJax6mC88aId7IrhNTpU67Qd:E0ChwZCF+2j4mibGxaLdYl

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

C2

146.59.161.7:48080

Attributes
  • auth_value

    c2955ed3813a798683a185a82e949f88

Targets

    • Target

      file.exe

    • Size

      332KB

    • MD5

      5e34921c1f635adc7977337b8cc28cd3

    • SHA1

      a4dd623c537b857698da72725d928e093b823bb5

    • SHA256

      0053d1419ec04041f1603063f4e7c0a6a370025de08a0bb69897cd6c757f1bb0

    • SHA512

      ef1b90dcbf73b5d8ef37b3c7baf30e228f151e66d5a7cf5028808976ef7bb2ff6fb1c82de8399480de1ca2780dcc082106efdf0ffa6418414c04faa4ad56ebda

    • SSDEEP

      3072:f8m6Y5tuh3wZD+SgX+9MBwAhy037ZnvOJbZJax6mC88aId7IrhNTpU67Qd:E0ChwZCF+2j4mibGxaLdYl

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks