redline

General

Target
76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b
Size 381KB
Sample230928-eellbshb86
SHA256 76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b
MD5 91bcd7b719ed166914dccdca25b28e14
SHA1 2cc7758c97bbe851cadcdbd6a3158358b690d97f
SHA512 5442042ce0c38637da8e55c65028c8c0392b282776ae206e2bc5e455158f3d69de4ecd43ab79ebb70257a28414afc2c17fdb8390a0902b989ae67257cc0070d0
SSDEEP 6144:8OCalXui16lr+3jHBwDp6mAOzZ34C76of+RlSOISDvP5XM3viKC:8Ozui16lrgmlheof+RQ6P5XGiKC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline logsdiller cloud (tg: @logsdillabot)infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

146.59.10.173:45035

Attributes

auth_value
3a050df92d0cf082b2cdaf87863616be

Targets

- Target
  76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b
- Size 381KB
- SHA256 76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b
- MD5 91bcd7b719ed166914dccdca25b28e14
- SHA1 2cc7758c97bbe851cadcdbd6a3158358b690d97f
- SHA512 5442042ce0c38637da8e55c65028c8c0392b282776ae206e2bc5e455158f3d69de4ecd43ab79ebb70257a28414afc2c17fdb8390a0902b989ae67257cc0070d0
- SSDEEP 6144:8OCalXui16lr+3jHBwDp6mAOzZ34C76of+RlSOISDvP5XM3viKC:8Ozui16lrgmlheof+RQ6P5XGiKC
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

redline logsdiller cloud (tg: @logsdillabot)infostealer spyware
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2