General

  • Target

    aac40675dc0a0bfbabd6bd56acaff56ab6f47b1f55ec9c4a7c4b16cfa213df2b

  • Size

    2.4MB

  • Sample

    221101-mr94fsbaa2

  • MD5

    6193449d69b97567869f8caa7fbf2a02

  • SHA1

    3753b5613587073110a056eb79828bdb33a06cd2

  • SHA256

    aac40675dc0a0bfbabd6bd56acaff56ab6f47b1f55ec9c4a7c4b16cfa213df2b

  • SHA512

    3caf4ce3c642bb994e1a1318c1a013147e100ef67682bfdf5533e751e0c5254ea0f77602fa12901326082e782789608766d574952e13f1e482097c6a727e93c0

  • SSDEEP

    24576:/DzdO2YwY5zWSqoMvWo6erJJu163vMr6N9TMnwE7RPLPN2AMhH7gl3RuQ55313/://dEStvMr89TMnwE7RPugl3B

Malware Config

Extracted

Family

redline

Botnet

123123nn

C2

62.204.41.31:33944

Attributes
  • auth_value

    534f6127cc1d3e70606c17c1a8acf137

Targets

    • Target

      aac40675dc0a0bfbabd6bd56acaff56ab6f47b1f55ec9c4a7c4b16cfa213df2b

    • Size

      2.4MB

    • MD5

      6193449d69b97567869f8caa7fbf2a02

    • SHA1

      3753b5613587073110a056eb79828bdb33a06cd2

    • SHA256

      aac40675dc0a0bfbabd6bd56acaff56ab6f47b1f55ec9c4a7c4b16cfa213df2b

    • SHA512

      3caf4ce3c642bb994e1a1318c1a013147e100ef67682bfdf5533e751e0c5254ea0f77602fa12901326082e782789608766d574952e13f1e482097c6a727e93c0

    • SSDEEP

      24576:/DzdO2YwY5zWSqoMvWo6erJJu163vMr6N9TMnwE7RPLPN2AMhH7gl3RuQ55313/://dEStvMr89TMnwE7RPugl3B

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks