General

  • Target

    761151c5b38afb3db02b26657463db7d716e0b0007e7b6ad8fa4b5aaa3f205db

  • Size

    2.5MB

  • Sample

    221101-l16lysaeg9

  • MD5

    5d480dd64c3222fa1fa1212cbad03d99

  • SHA1

    5d45bf4fdfac75e878801ea76c55f251d353cd04

  • SHA256

    761151c5b38afb3db02b26657463db7d716e0b0007e7b6ad8fa4b5aaa3f205db

  • SHA512

    00e79c285afa293c5df5131020407385c3febe593a59de55c70a2bf59a800459f6896273a34d66cf8b2ae3e68d4aeb9f1ad35828d0679e09e26d0183f2a75fc2

  • SSDEEP

    24576:D2xrPU3VYGYnerKBVuUMkzd36+6cMe6ob4Ebvxfl6Cs2msVpLI+hRdqOml3RuQ5B:DoPU8rDx4Ks2msVpROl3D

Malware Config

Extracted

Family

redline

Botnet

SY832901

C2

62.204.41.31:33944

Attributes
  • auth_value

    746376821a0ac782895b844ba45ffa2e

Targets

    • Target

      761151c5b38afb3db02b26657463db7d716e0b0007e7b6ad8fa4b5aaa3f205db

    • Size

      2.5MB

    • MD5

      5d480dd64c3222fa1fa1212cbad03d99

    • SHA1

      5d45bf4fdfac75e878801ea76c55f251d353cd04

    • SHA256

      761151c5b38afb3db02b26657463db7d716e0b0007e7b6ad8fa4b5aaa3f205db

    • SHA512

      00e79c285afa293c5df5131020407385c3febe593a59de55c70a2bf59a800459f6896273a34d66cf8b2ae3e68d4aeb9f1ad35828d0679e09e26d0183f2a75fc2

    • SSDEEP

      24576:D2xrPU3VYGYnerKBVuUMkzd36+6cMe6ob4Ebvxfl6Cs2msVpLI+hRdqOml3RuQ5B:DoPU8rDx4Ks2msVpROl3D

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks