redline | 132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf | Triage

Sharing

General

Target

132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf.exe
Size

459KB
Sample

240523-bhd4wafh4v
MD5

e154829a16292c782b579d217e0ea8bf
SHA1

5d2fb1535930184e7212b5fb780c638f32a03cee
SHA256

132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf
SHA512

d0acbc1d810f628107e095959a2c53ef6e58adcc8631f1ab16353b1294b7f51f13b1ff9936ab5e86aff2d3c4fad9c56f3df263d9f7b27de8ffa3cd508537a300
SSDEEP

12288:mQJRsrrQqYvbeUVOyJ3GJNu0ADIJTls9tJBKM1I59rM:akkyJoNYDOsrqM259A

Score

10^/10

redline logsdiller cloud (tg: @logsdillabot)discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

5.42.65.115:40551

Targets

- Target
  
  132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf.exe
- Size
  
  459KB
- MD5
  
  e154829a16292c782b579d217e0ea8bf
- SHA1
  
  5d2fb1535930184e7212b5fb780c638f32a03cee
- SHA256
  
  132fe6d8e5c0026b4f9e0de786ccc4a35fc22d86821d230f8d8ea924e825ffbf
- SHA512
  
  d0acbc1d810f628107e095959a2c53ef6e58adcc8631f1ab16353b1294b7f51f13b1ff9936ab5e86aff2d3c4fad9c56f3df263d9f7b27de8ffa3cd508537a300
- SSDEEP
  
  12288:mQJRsrrQqYvbeUVOyJ3GJNu0ADIJTls9tJBKM1I59rM:akkyJoNYDOsrqM259A
Score

10^/10

redline logsdiller cloud (tg: @logsdillabot)discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

Install Root Certificate

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2

redlinelogsdiller cloud (tg: @logsdillabot)discoveryinfostealerspywarestealer