General
- Target file.exe
- Size 321KB
- Sample230713-2cg7fsbd87
- SHA256 bdd67a2d07debbf8140da392ef933eb53172beae105a4981e7bf8938f393e667
- MD5 bd0ac879444d09501ecd26bfb64e115e
- SHA1 144faa90681bc3c23928e75b46720f9213435c33
- SHA512 8ad99202617f1096678993620cff723d1ff9f1321b3b0ebd4d2614792d2fc04ace4172679bb7c2a90974571c678db7c4bf52b9d48b339e58a1927b02c197dcfc
- SSDEEP 6144:hMtLmPa2BkK5VEHMVsNovIXd8WB0hO1b9HEqwlf:kCPa2Bx5usVGovIXd8WbzEq+
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230712-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
LogsDiller Cloud (Telegram: @logsdillabot)
C2
-
147.135.165.22:17748
Attributes
-
auth_value
c2955ed3813a798683a185a82e949f88
Targets
-
- Target file.exe
- Size 321KB
- SHA256 bdd67a2d07debbf8140da392ef933eb53172beae105a4981e7bf8938f393e667
- MD5 bd0ac879444d09501ecd26bfb64e115e
- SHA1 144faa90681bc3c23928e75b46720f9213435c33
- SHA512 8ad99202617f1096678993620cff723d1ff9f1321b3b0ebd4d2614792d2fc04ace4172679bb7c2a90974571c678db7c4bf52b9d48b339e58a1927b02c197dcfc
- SSDEEP 6144:hMtLmPa2BkK5VEHMVsNovIXd8WB0hO1b9HEqwlf:kCPa2Bx5usVGovIXd8WbzEq+
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.