Resubmissions

10/01/2023, 20:41

230110-zgh87she8210

09/01/2023, 13:23

230109-qmzcyahg5z8

30/12/2022, 04:52

221230-fhnqjafa367

29/12/2022, 23:57

221229-3z3x4shg5y8

29/12/2022, 09:56

221229-lyp67afh7x4

29/12/2022, 09:28

221229-lfpspsfh5s10

29/12/2022, 04:18

221229-exfssscc881

29/12/2022, 04:12

221229-esw9zsfd3z8

18/12/2022, 12:11

221218-pcmqqabh428

04/12/2022, 12:48

221204-p157zaec6t10

General

  • Target
    https://google.com
  • Sample221204-p157zaec6t

Malware Config

Extracted

Family
  • redline

Botnet
  • MILLIONDOLLARSSSSSSSSS

C2
  • 195.201.122.190:45976

Attributes
  • auth_value

    971e3b56584ce491575444038fafa07c

Targets

    • Target
      https://google.com
    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Executes dropped EXE

    • Uses the VBS compiler for execution

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks