General

  • Size

    926KB

  • Sample

    220923-hdg4asddc7

  • MD5

    661a6a25cbdbec6543e74fae455e349a

  • SHA1

    c5486f079370b7a0b2c1dbd170035ce25da8163e

  • SHA256

    60c85fce1fbb2d9aaf9737335785e6c0c55b1e42a45394aa7c408b93f2b9bdf0

  • SHA512

    b2514f2f29d73a41a4c26c81c1997dd3cd91258461b71da86e7cfe6f02d416cd13d11747be9b274a612b08544cd4389b7c2f0337a4a2b020d7c5e8babf51bb5b

Malware Config

Extracted

Family

redline

Botnet

mag21

C2

jamesmillion.xyz:47481

Attributes
auth_value
b5ecf039f4b13b472d3c95fc6fe41fc8

Targets

    • Target

      661a6a25cbdbec6543e74fae455e349a.exe

    • Size

      926KB

    • MD5

      661a6a25cbdbec6543e74fae455e349a

    • SHA1

      c5486f079370b7a0b2c1dbd170035ce25da8163e

    • SHA256

      60c85fce1fbb2d9aaf9737335785e6c0c55b1e42a45394aa7c408b93f2b9bdf0

    • SHA512

      b2514f2f29d73a41a4c26c81c1997dd3cd91258461b71da86e7cfe6f02d416cd13d11747be9b274a612b08544cd4389b7c2f0337a4a2b020d7c5e8babf51bb5b

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Execution

      Exfiltration

        Impact

          Initial Access

            Lateral Movement

              Persistence

                Privilege Escalation