Overview

overview

10

Static

static

3

8e38e8ecd4...11.exe

windows7-x64

3

8e38e8ecd4...11.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8e38e8ecd481eb08ceaa4ae363251311.exe

  • Size

    915KB

  • Sample

    240527-p33vmaeb74

  • MD5

    8e38e8ecd481eb08ceaa4ae363251311

  • SHA1

    8c2a06c4c7b52cb9cd01c414732597e9289b3ad4

  • SHA256

    036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40

  • SHA512

    c02a7be29b8012778a9028b67d71384e0a6a60857f880bf858099aef5a41a21c0068cfd2ff4116176493c28938d5e799ca18738a6e29335c3423f895305d016f

  • SSDEEP

    24576:7tASL4DpnNBcMxDlxTWTn6WHmTSHMLir8/dp97A:f4DpnNBcMTxTyYSY1P7A

Score
10/10
redlinelogsdiller cloud (tg: @logsdillabot)discoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

5.42.65.115:40551

Targets

    • Target

      8e38e8ecd481eb08ceaa4ae363251311.exe

    • Size

      915KB

    • MD5

      8e38e8ecd481eb08ceaa4ae363251311

    • SHA1

      8c2a06c4c7b52cb9cd01c414732597e9289b3ad4

    • SHA256

      036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40

    • SHA512

      c02a7be29b8012778a9028b67d71384e0a6a60857f880bf858099aef5a41a21c0068cfd2ff4116176493c28938d5e799ca18738a6e29335c3423f895305d016f

    • SSDEEP

      24576:7tASL4DpnNBcMxDlxTWTn6WHmTSHMLir8/dp97A:f4DpnNBcMTxTyYSY1P7A

    Score
    10/10
    redlinelogsdiller cloud (tg: @logsdillabot)discoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks