Overview

overview

10

Static

static

1

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93

  • Size

    3.1MB

  • Sample

    240624-gdjfpaydmc

  • MD5

    d3280c8db77e7d70bc80ad58e875dcf5

  • SHA1

    e344a0bc5e42fba4ee4bd89827b46642481fb67c

  • SHA256

    adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93

  • SHA512

    3c3bdb76929d39fc83fb244dca15ddf358bc1fa0d447d28c4996c5c389cd411c396b6ca20d0dd64728b6e8ab13591c538cfdc01acc3c62a04793243646c28d2c

  • SSDEEP

    49152:I5cmt/rNUf4GLsBxS+8cY3L0FnpyDLuNblwy:I5c+/osBxnE4npOuNblh

Score
10/10
redlinelogsdiller cloud (tg: @logsdillabot)infostealerspyware

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

5.42.65.92:27953

Targets

    • Target

      adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93

    • Size

      3.1MB

    • MD5

      d3280c8db77e7d70bc80ad58e875dcf5

    • SHA1

      e344a0bc5e42fba4ee4bd89827b46642481fb67c

    • SHA256

      adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93

    • SHA512

      3c3bdb76929d39fc83fb244dca15ddf358bc1fa0d447d28c4996c5c389cd411c396b6ca20d0dd64728b6e8ab13591c538cfdc01acc3c62a04793243646c28d2c

    • SSDEEP

      49152:I5cmt/rNUf4GLsBxS+8cY3L0FnpyDLuNblwy:I5c+/osBxnE4npOuNblh

    Score
    10/10
    redlinelogsdiller cloud (tg: @logsdillabot)infostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks