General

  • Target

    file

  • Size

    378KB

  • Sample

    231012-cjjleshf8y

  • MD5

    14a7013b921ea42e4192b57f2ce43c32

  • SHA1

    b619982e5003ba5b3f64ae4f1661b00030e43ca0

  • SHA256

    a8732c7648d46289f08418bf95a07691f4df340b3fa7111fb1b7a31d6c43122c

  • SHA512

    10f5952ba58660f1a5a25517daafa1f3ce94ca83de8271c48a2135d513ab1a0ffc70be06c3263ae2e627317df1d98df94fb7ee5113eb5946814161be19aff2ab

  • SSDEEP

    6144:ffLX/pgd2f0gqLDfn5AOV4qKdayTp8KuJcFhLHDkWCKXZNMNuB3NkA6QmCnVRxoC:fD/pNC5/oDp8KuJcFhLHbTd9kJHCnVRp

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

C2

51.38.95.107:42494

Attributes
  • auth_value

    c2955ed3813a798683a185a82e949f88

Targets

    • Target

      file

    • Size

      378KB

    • MD5

      14a7013b921ea42e4192b57f2ce43c32

    • SHA1

      b619982e5003ba5b3f64ae4f1661b00030e43ca0

    • SHA256

      a8732c7648d46289f08418bf95a07691f4df340b3fa7111fb1b7a31d6c43122c

    • SHA512

      10f5952ba58660f1a5a25517daafa1f3ce94ca83de8271c48a2135d513ab1a0ffc70be06c3263ae2e627317df1d98df94fb7ee5113eb5946814161be19aff2ab

    • SSDEEP

      6144:ffLX/pgd2f0gqLDfn5AOV4qKdayTp8KuJcFhLHDkWCKXZNMNuB3NkA6QmCnVRxoC:fD/pNC5/oDp8KuJcFhLHbTd9kJHCnVRp

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks