General

  • Target

    e63036cb18083af12146e4a679bb5ae0cefea310a083c6dc78a8c88365896fe5

  • Size

    323KB

  • Sample

    240926-29ywgawcnf

  • MD5

    72f7c1208efd829ad580e839494a681c

  • SHA1

    d636bbd7470cc3bfa5047d52ba78c48d5269f3f7

  • SHA256

    e63036cb18083af12146e4a679bb5ae0cefea310a083c6dc78a8c88365896fe5

  • SHA512

    7fd40218ce72b1a9ff422f9d92dbccdda376eb4e519c90a61fdb48868b9effb8f13f37dc1e288c0fcf4717c946433252518fd16bc49480238d8a46c459310d06

  • SSDEEP

    6144:JRJ+dXQfkINIrPVJQ1gjbNL1qa41Brn1ouauy+gPE06qlGkNh8EYs:IImrnvbNi/quy+cEY8QV

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

193.233.255.84:4284

Targets

    • Target

      e63036cb18083af12146e4a679bb5ae0cefea310a083c6dc78a8c88365896fe5

    • Size

      323KB

    • MD5

      72f7c1208efd829ad580e839494a681c

    • SHA1

      d636bbd7470cc3bfa5047d52ba78c48d5269f3f7

    • SHA256

      e63036cb18083af12146e4a679bb5ae0cefea310a083c6dc78a8c88365896fe5

    • SHA512

      7fd40218ce72b1a9ff422f9d92dbccdda376eb4e519c90a61fdb48868b9effb8f13f37dc1e288c0fcf4717c946433252518fd16bc49480238d8a46c459310d06

    • SSDEEP

      6144:JRJ+dXQfkINIrPVJQ1gjbNL1qa41Brn1ouauy+gPE06qlGkNh8EYs:IImrnvbNi/quy+cEY8QV

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks