redline

General

Target

b79a3355266f15c8b8a46803aa3d3ce8.exe
Size

909KB
Sample

240526-wyrecsfb7w
MD5

b79a3355266f15c8b8a46803aa3d3ce8
SHA1

7bbd35f0b831065e81430349b4377a2f02075cdd
SHA256

13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea
SHA512

c2272e1de7130f444c4d6348734e151f1bb308f677554ffea27f665087ada3e9712130bed91267e7c2371c8d82bef70f409a16bd82ae8db58f7c17a5fc87c3c0
SSDEEP

24576:OtASL4DJnNps+2Z3ciTWTn6WHGxju3MELhqb7S+AXOQEZAsS:K4DJnNps+JiTyejB7S+AYBS

Score

10^/10

redline logsdiller cloud (telegram: @logsdillabot)discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

C2

5.42.65.115:40551

Targets

- Target
  
  b79a3355266f15c8b8a46803aa3d3ce8.exe
- Size
  
  909KB
- MD5
  
  b79a3355266f15c8b8a46803aa3d3ce8
- SHA1
  
  7bbd35f0b831065e81430349b4377a2f02075cdd
- SHA256
  
  13d02ba7a1831561b73374a013d54430f0d2a62c97b101a6d0e43548fc9c23ea
- SHA512
  
  c2272e1de7130f444c4d6348734e151f1bb308f677554ffea27f665087ada3e9712130bed91267e7c2371c8d82bef70f409a16bd82ae8db58f7c17a5fc87c3c0
- SSDEEP
  
  24576:OtASL4DJnNps+2Z3ciTWTn6WHGxju3MELhqb7S+AXOQEZAsS:K4DJnNps+JiTyejB7S+AYBS
Score

10^/10

redline logsdiller cloud (telegram: @logsdillabot)discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

RedLine payload

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2