General

  • Target

    file

  • Size

    320KB

  • Sample

    230713-s52bcshc65

  • MD5

    278c85d98d34bbb79042c10d9f7e3240

  • SHA1

    6b0d72951d60416237c0395aa2e024633185660d

  • SHA256

    e77ae5cb696891c9c81ec6c871261968ae12c334cd1d145c7f5f9e0115181dd5

  • SHA512

    57476984e6f2f31d4d2c250b33caefd31a175d3e0aa723d6e464734ff413e4c4b050eca0151796a22baf42099273d875554747d88faa5573226d41849f173c7b

  • SSDEEP

    6144:d5BL3vwP/NTu2gkSuXSPlKzXM/wioXAqo:dHLvKNTrbS9KzXmow

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

C2

147.135.165.22:17748

Attributes
  • auth_value

    c2955ed3813a798683a185a82e949f88

Targets

    • Target

      file

    • Size

      320KB

    • MD5

      278c85d98d34bbb79042c10d9f7e3240

    • SHA1

      6b0d72951d60416237c0395aa2e024633185660d

    • SHA256

      e77ae5cb696891c9c81ec6c871261968ae12c334cd1d145c7f5f9e0115181dd5

    • SHA512

      57476984e6f2f31d4d2c250b33caefd31a175d3e0aa723d6e464734ff413e4c4b050eca0151796a22baf42099273d875554747d88faa5573226d41849f173c7b

    • SSDEEP

      6144:d5BL3vwP/NTu2gkSuXSPlKzXM/wioXAqo:dHLvKNTrbS9KzXmow

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks