Overview

overview

10

Static

static

1

04f289c698...f0.exe

windows7-x64

10

04f289c698...f0.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    04f289c698fef1e3e06e1062195919d5255c7b4ae768ebad747b6705d8c3bbf0.zip

  • Size

    392KB

  • Sample

    231119-3ggxxsdd3z

  • MD5

    244a3042948f79316ab9d0e6c5cb26ae

  • SHA1

    e3c13e7ff2efb8931155bf6aab20dec83318d57c

  • SHA256

    2dfc91b9175a503bcdd4f13da9f3d6d5af6f7177bb2b886f1b8738e6b4d8dd83

  • SHA512

    4068df0f5decc65c913426fef74f8403f54ead223ed28b706fa988d1a50522ba46a8aa84f8c59f3afd91ec4c1fd71767648bc5be79ef8a469c305f2239601f87

  • SSDEEP

    12288:7TbUNldKftStXJ2+kc3EgzwcPtAlds6g94pF7FYq2Lt2OQ0Ij8:7TbUHYfOXJ255sfi7FS2OQ07

Score
10/10
redlinelogsdiller cloud (telegram: @logsdillabot)infostealerspyware

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

C2

194.49.94.142:41292

Targets

    • Target

      04f289c698fef1e3e06e1062195919d5255c7b4ae768ebad747b6705d8c3bbf0.exe

    • Size

      1.1MB

    • MD5

      080e613a0159574b6cb822b54c5f6862

    • SHA1

      4cc149abc17c04e7bca034d0b9e84a348f82cea1

    • SHA256

      04f289c698fef1e3e06e1062195919d5255c7b4ae768ebad747b6705d8c3bbf0

    • SHA512

      f7386ea4e0346e6feb8f256d2c37825e287fcf71352d3dacbecd3e07b78e605da6978938a4c1c8bc5ce0b80621505c9e30e787ae2ae5e7e24f5b7371b5212334

    • SSDEEP

      12288:SZ8HouF4ZYWzHZbeeGXr3l37E9MqZZZM91QCZYuOLalMwWZVupgX69:IuF4ZYWzHZCLuJZZZM91Fz9WCqX69

    Score
    10/10
    redlinelogsdiller cloud (telegram: @logsdillabot)infostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks