General

  • Target

    file

  • Size

    238KB

  • Sample

    230808-s42whafb6z

  • MD5

    807916e6b1df79788af9136127b8c969

  • SHA1

    3e38a92fdc06bf452eff0125a8b48ffd67e2e41f

  • SHA256

    bc3df4646e8d0ebbeb3dbcb94cea81a59f9d8eac7acc0420e9bc0f1144ee5f3e

  • SHA512

    1e99b77a5969b4f4a57c7875eb250c0677b9602b53db8f116f623fe976178d07f33d3d7de4d083a00c3f7ff6076fdc32785087416b4be07a2283cf8ef483aa93

  • SSDEEP

    3072:fsn+amYKthK2NyyX0eua33Th2EDslI2GsYFh7XAh+/NOaLYlQnPF0clriOguz3N:frdYkhK1ehHP1llOaLyQnPF0clWuz

Malware Config

Extracted

Family

redline

Botnet

CosmicLog$

C2

185.225.73.32:14387

Attributes
  • auth_value

    ac0f73120491f375e8704fe183735314

Targets

    • Target

      file

    • Size

      238KB

    • MD5

      807916e6b1df79788af9136127b8c969

    • SHA1

      3e38a92fdc06bf452eff0125a8b48ffd67e2e41f

    • SHA256

      bc3df4646e8d0ebbeb3dbcb94cea81a59f9d8eac7acc0420e9bc0f1144ee5f3e

    • SHA512

      1e99b77a5969b4f4a57c7875eb250c0677b9602b53db8f116f623fe976178d07f33d3d7de4d083a00c3f7ff6076fdc32785087416b4be07a2283cf8ef483aa93

    • SSDEEP

      3072:fsn+amYKthK2NyyX0eua33Th2EDslI2GsYFh7XAh+/NOaLYlQnPF0clriOguz3N:frdYkhK1ehHP1llOaLyQnPF0clWuz

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

MITRE ATT&CK Enterprise v15

Tasks