redline | c9b088d954f9292346595b6c472d9a08fcd42a939286f30bd6dd4dc4069c6bf8 | Triage

Sharing

General

Target

c9b088d954f9292346595b6c472d9a08fcd42a939286f30bd6dd4dc4069c6bf8.exe
Size

526KB
Sample

240523-g624hagc56
MD5

3b51a1d5264413862f4692212ee4d4ba
SHA1

569ef139001af3477e4d50d5c566ab0f065c2089
SHA256

c9b088d954f9292346595b6c472d9a08fcd42a939286f30bd6dd4dc4069c6bf8
SHA512

004426b1a00e42faec499bd16c370dcacd27c0e7f32168f1b0f54ba703767506ab8ee56ede260ee1ae4e45b9951c9959a85dc2094f6b2e5582c5c9879dc8e564
SSDEEP

12288:CfMjGqNc08m5Gfjx2Blk2dkCWnCJqHe8fLtpZq8:JGSLCcvkGWns/8jtq

Score

10^/10

redline logsdiller cloud (tg: @logsdillabot)infostealer

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

5.42.65.85:45779

Targets

- Target
  
  c9b088d954f9292346595b6c472d9a08fcd42a939286f30bd6dd4dc4069c6bf8.exe
- Size
  
  526KB
- MD5
  
  3b51a1d5264413862f4692212ee4d4ba
- SHA1
  
  569ef139001af3477e4d50d5c566ab0f065c2089
- SHA256
  
  c9b088d954f9292346595b6c472d9a08fcd42a939286f30bd6dd4dc4069c6bf8
- SHA512
  
  004426b1a00e42faec499bd16c370dcacd27c0e7f32168f1b0f54ba703767506ab8ee56ede260ee1ae4e45b9951c9959a85dc2094f6b2e5582c5c9879dc8e564
- SSDEEP
  
  12288:CfMjGqNc08m5Gfjx2Blk2dkCWnCJqHe8fLtpZq8:JGSLCcvkGWns/8jtq
Score

10^/10

redline logsdiller cloud (tg: @logsdillabot)infostealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

redlinelogsdiller cloud (tg: @logsdillabot)infostealer