General

  • Target

    abb713cf90e8345c0b6b79345cbdc9d6.bin

  • Size

    984KB

  • Sample

    240831-b3ssrsycme

  • MD5

    7c285103491bfb15b1462b3298ced5bc

  • SHA1

    5df81ee79e19c52df95b4ed8f485c21257ee7e1d

  • SHA256

    df0dc53bc12e9886219c5b4a7f5545c388a124969ca02aaaed58a0c882ce3a67

  • SHA512

    95f90874468e25c5bb1fb7e8a50b5ad155a3f917c32ca74e2f84a922ef96705a32c0e4f02e04844799a7fd0ffa4923a8eed5856b97b887e4213c3fd85c4fe2d6

  • SSDEEP

    24576:JPsIqAaXjZgpskEWk1vwFs1JwlYxOmm+UdH31EXuoxpsd:JPDMjepsk61vwFCwAvU/EBxCd

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

147.45.47.251:2149

Targets

    • Target

      bfe19615479cff03ad963d8206c2e3e89ddafd30bb4978e27976295214d3f295.exe

    • Size

      1.0MB

    • MD5

      abb713cf90e8345c0b6b79345cbdc9d6

    • SHA1

      67e705d4070b58994f0b718005d5f07fef824192

    • SHA256

      bfe19615479cff03ad963d8206c2e3e89ddafd30bb4978e27976295214d3f295

    • SHA512

      809b8c6aae46674c4c5fe24a98ae1fa065ab24d44c42e56b85946d7cc039f4139eb34e62daaf2ea1058180884a72c411d639c79eacc491e7fdb555a11b4dd524

    • SSDEEP

      24576:T3ThU20saWF461GGhJryB+dItlXPoxt1tXNq7pk04o9wynZTAgEXt:7OcXDGG/uua1Y3XwpkkagGt

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks