General

  • Target

    tmp

  • Size

    396KB

  • Sample

    230720-1lebgsbd6v

  • MD5

    d5aeaaa9c0373515524f92d713aa8ce8

  • SHA1

    a3ccce27b4a191cb3435f7d681cdb0c5a5c65a10

  • SHA256

    6eaec8aaa320b804bf32bde89dfe45ae19c69636b1bd0b38ac0034afd6096d11

  • SHA512

    2bbfdb7089abcbdcf87097530aa6aaae2a7a82f4383e466658769d7039d96db2f97063c43f5b02ed68138e338663a2700b147bc54c1517a8b7255ab8747a597a

  • SSDEEP

    6144:UBBLOrDOgpUv96mNGlIUXfXuQ5B5FB6/pG+LS:+BCvWv906SfL5B5uEqS

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

C2

178.32.90.250:29608

Attributes
  • auth_value

    c2955ed3813a798683a185a82e949f88

Targets

    • Target

      tmp

    • Size

      396KB

    • MD5

      d5aeaaa9c0373515524f92d713aa8ce8

    • SHA1

      a3ccce27b4a191cb3435f7d681cdb0c5a5c65a10

    • SHA256

      6eaec8aaa320b804bf32bde89dfe45ae19c69636b1bd0b38ac0034afd6096d11

    • SHA512

      2bbfdb7089abcbdcf87097530aa6aaae2a7a82f4383e466658769d7039d96db2f97063c43f5b02ed68138e338663a2700b147bc54c1517a8b7255ab8747a597a

    • SSDEEP

      6144:UBBLOrDOgpUv96mNGlIUXfXuQ5B5FB6/pG+LS:+BCvWv906SfL5B5uEqS

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks