General

  • Target

    file

  • Size

    337KB

  • Sample

    230713-hb21page6z

  • MD5

    15156d5a1fcf3e37f9c3b04025c9f3e9

  • SHA1

    d6151c09c81516793597bb08aab1ae4be6ad4f86

  • SHA256

    74edab3b0ba41b9d02d35d1b4b5a5791990711920ad81a3b7bcaabfcc45c4c5a

  • SHA512

    cc0614de7e85c77303ef5ceec75713ef20137b4ffa271af7bae4e0c69992c59ee768043304fce8a2c06fb6eecf32be8da939d958d05382b7a0b16bcff85978d0

  • SSDEEP

    6144:HpCiPo7e/UqZVm9tMgstXWiOFPQnRwgF4:JFPbbV7qFInRwgF4

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

C2

147.135.165.22:17748

Attributes
  • auth_value

    c2955ed3813a798683a185a82e949f88

Targets

    • Target

      file

    • Size

      337KB

    • MD5

      15156d5a1fcf3e37f9c3b04025c9f3e9

    • SHA1

      d6151c09c81516793597bb08aab1ae4be6ad4f86

    • SHA256

      74edab3b0ba41b9d02d35d1b4b5a5791990711920ad81a3b7bcaabfcc45c4c5a

    • SHA512

      cc0614de7e85c77303ef5ceec75713ef20137b4ffa271af7bae4e0c69992c59ee768043304fce8a2c06fb6eecf32be8da939d958d05382b7a0b16bcff85978d0

    • SSDEEP

      6144:HpCiPo7e/UqZVm9tMgstXWiOFPQnRwgF4:JFPbbV7qFInRwgF4

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks