General

  • Target

    6702392e56414e5569fe81bbe157836f3fb2b96455d744126c77e7025ebd3b7b

  • Size

    323KB

  • Sample

    240926-2lp9esvbjf

  • MD5

    c61cc62b59b5959951d1158887b20b7b

  • SHA1

    f9052b6c037887880dcedb4b267101aebf555a8a

  • SHA256

    6702392e56414e5569fe81bbe157836f3fb2b96455d744126c77e7025ebd3b7b

  • SHA512

    8aa4f569699bc38dbb58fb3d19beb65d6537f54dc5a2f8f38923d16c9355f1d21b28e0334d02e4ee681e477cabfff19c6e9cd448de320291050c6cc671bc19b0

  • SSDEEP

    6144:nHCvNULzTf8DVnDIZo4b70JkgYrgJ0WiiTikz1iRKXQL/0d98t:HkULf0hDh4b7wk7MJPis5iIX/6

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

193.233.255.77:1891

Targets

    • Target

      6702392e56414e5569fe81bbe157836f3fb2b96455d744126c77e7025ebd3b7b

    • Size

      323KB

    • MD5

      c61cc62b59b5959951d1158887b20b7b

    • SHA1

      f9052b6c037887880dcedb4b267101aebf555a8a

    • SHA256

      6702392e56414e5569fe81bbe157836f3fb2b96455d744126c77e7025ebd3b7b

    • SHA512

      8aa4f569699bc38dbb58fb3d19beb65d6537f54dc5a2f8f38923d16c9355f1d21b28e0334d02e4ee681e477cabfff19c6e9cd448de320291050c6cc671bc19b0

    • SSDEEP

      6144:nHCvNULzTf8DVnDIZo4b70JkgYrgJ0WiiTikz1iRKXQL/0d98t:HkULf0hDh4b7wk7MJPis5iIX/6

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks