Overview

overview

10

Static

static

3

f641a3e31a...a9.exe

windows7-x64

10

f641a3e31a...a9.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3bbdfbcc0bf3dddbd6e8706113d81a36.bin

  • Size

    390KB

  • Sample

    231127-b3al7ade7s

  • MD5

    3b8b3cad916d41dd1de193b9df43b60b

  • SHA1

    9bbd2fd9145f3e744c5fb1bdaf5f663e3e99679f

  • SHA256

    9c0aa9652d9540e44e968c0c8076ee5c544fd9cc75a7c540ff3f69c4d1509ed2

  • SHA512

    046ceb38197585bdb37aac29bd8302b72fbf61e6cc1044c8e1024fd50c608d82cdec0e3be4d634e38fe62f78c6ec57e043c9e7bb592533264eb3031864606c54

  • SSDEEP

    6144:eZcbjTvq299qak1Rwu0A6szFX4ojQF4zOJhiM7CqHkf643GOBq9Ab:eZ2v3k1RSrlFSIhRBkf9GOBq9I

Score
10/10
redlinelogsdiller cloud (telegram: @logsdillabot)infostealerspyware

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

C2

194.49.94.181:40264

Targets

    • Target

      f641a3e31afa3b0502d4490f22bb56b480f8a50a45dd38e41d53370d325943a9.exe

    • Size

      1.1MB

    • MD5

      3bbdfbcc0bf3dddbd6e8706113d81a36

    • SHA1

      119bf65626c051a451af1d1d1bc4e1b3986ab052

    • SHA256

      f641a3e31afa3b0502d4490f22bb56b480f8a50a45dd38e41d53370d325943a9

    • SHA512

      912e18af291fe3150c94d3a3701de30335755ca61afdc6969370b2c13f3ecdbe66f54cfdd21dc7aa91e9a0199ece370e266a8472088c4a03286491d565f0e263

    • SSDEEP

      12288:cQYUdZzN0OFYvMeTVRq6TFXJdzIEKJGnaQXiugklpJPK4lopDlQFeJ:3dZh0OFYvMeTVRfXcdJG5hevM8

    Score
    10/10
    redlinelogsdiller cloud (telegram: @logsdillabot)infostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks