General

  • Target

    eb980b1982521babfe6ae255a26701b2db2e8b3296025168278a0b3f406b945c

  • Size

    349KB

  • Sample

    230723-nzs1ksea28

  • MD5

    cf880c0b59c7b3c402573cc089335281

  • SHA1

    092b3d771300bc438db8b0b9014f3e05f0f0ae2d

  • SHA256

    eb980b1982521babfe6ae255a26701b2db2e8b3296025168278a0b3f406b945c

  • SHA512

    c8f2f5a1a2e5160031e5e67de0265e285085bae87c75bffd4c35c7be6fd306c07197d56aa514900109f536e05da1cb9ae8a23aab54319aea3aa59622baee89cc

  • SSDEEP

    6144:DnlbpEoVJnkSpp97g4Rq+LnbdmgWiM+XbQEvBa:j73VJkSpptLlXW+rQYBa

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

178.32.90.250:29608

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Targets

    • Target

      eb980b1982521babfe6ae255a26701b2db2e8b3296025168278a0b3f406b945c

    • Size

      349KB

    • MD5

      cf880c0b59c7b3c402573cc089335281

    • SHA1

      092b3d771300bc438db8b0b9014f3e05f0f0ae2d

    • SHA256

      eb980b1982521babfe6ae255a26701b2db2e8b3296025168278a0b3f406b945c

    • SHA512

      c8f2f5a1a2e5160031e5e67de0265e285085bae87c75bffd4c35c7be6fd306c07197d56aa514900109f536e05da1cb9ae8a23aab54319aea3aa59622baee89cc

    • SSDEEP

      6144:DnlbpEoVJnkSpp97g4Rq+LnbdmgWiM+XbQEvBa:j73VJkSpptLlXW+rQYBa

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks