General
- Target 2468-60-0x0000000003540000-0x0000000003574000-memory.dmp
- Size 208KB
- Sample230813-egh8zsgh93
- SHA256 1b4b695ff0e3c2bb369e4ae2614f6c3cd71862a86bcc6baadf733fadf9279c5d
- MD5 dae7da4e75f28ff614d2ff5df2bb690e
- SHA1 e2e3cbac745950616872a951f7a7ce1bc7c6b8c8
- SHA512 84ac88936603908ef41809069eda905cab82e4a690840ef4a1c6ec4e9f5022cdddd98b2c41d504e4f42035a4f6ec93427fd0416ed888ea9797d76178bc1c1308
- SSDEEP 3072:jzhrmtU/f3YIInGpDvw/1oPYqSaVXr2nhK9w4hxwaD8d8e8hl:5rmtU/gIInG6oAqBVXrmhKZ5e
- MD5 SHA1 SHA512 SSDEEP
Behavioral task
behavioral1
Sample
2468-60-0x0000000003540000-0x0000000003574000-memory.exe
Resource
win7-20230712-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2468-60-0x0000000003540000-0x0000000003574000-memory.exe
Resource
win10v2004-20230703-en
5 signatures
150 seconds
Malware Config
Extracted
Family
-
redline
Botnet
-
LogsDiller Cloud (TG: @logsdillabot)
C2
-
51.83.170.21:19447
Attributes
-
auth_value
3a050df92d0cf082b2cdaf87863616be
Targets
-
- Target 2468-60-0x0000000003540000-0x0000000003574000-memory.dmp
- Size 208KB
- SHA256 1b4b695ff0e3c2bb369e4ae2614f6c3cd71862a86bcc6baadf733fadf9279c5d
- MD5 dae7da4e75f28ff614d2ff5df2bb690e
- SHA1 e2e3cbac745950616872a951f7a7ce1bc7c6b8c8
- SHA512 84ac88936603908ef41809069eda905cab82e4a690840ef4a1c6ec4e9f5022cdddd98b2c41d504e4f42035a4f6ec93427fd0416ed888ea9797d76178bc1c1308
- SSDEEP 3072:jzhrmtU/f3YIInGpDvw/1oPYqSaVXr2nhK9w4hxwaD8d8e8hl:5rmtU/gIInG6oAqBVXrmhKZ5e
- MD5 SHA1 SHA512 SSDEEP
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting