General

  • Target

    1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe

  • Size

    214KB

  • Sample

    221225-by9kqaeb21

  • MD5

    c1adaf98f8c567048839897999f84f9c

  • SHA1

    241fb4a1f39cc4ea63f135f40795bb2c6f169f23

  • SHA256

    1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a

  • SHA512

    5be1247fd7ca12b99c8f58592c1fabff1f6091f17e79a53a1b0064ed2d032b04cb9e989e4029d91d90204a9b5bd126a7d1981987cccea077f3bce7e8906d5c7e

  • SSDEEP

    3072:aQw78gtyq/HfLTr4Ch/KjL4BpwxrY34YMPvBIrVgkhtztAIQ5AovygF7ocTt/oxa:aQ0/LTrB/KcDMnByVgkLztnaygF8g/r

Malware Config

Extracted

Family

redline

Botnet

@Santey6

C2

baaffanyela.xyz:80

Attributes
  • auth_value

    2655caacc2a09c1218b5bf48d5e3a140

Targets

    • Target

      1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe

    • Size

      214KB

    • MD5

      c1adaf98f8c567048839897999f84f9c

    • SHA1

      241fb4a1f39cc4ea63f135f40795bb2c6f169f23

    • SHA256

      1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a

    • SHA512

      5be1247fd7ca12b99c8f58592c1fabff1f6091f17e79a53a1b0064ed2d032b04cb9e989e4029d91d90204a9b5bd126a7d1981987cccea077f3bce7e8906d5c7e

    • SSDEEP

      3072:aQw78gtyq/HfLTr4Ch/KjL4BpwxrY34YMPvBIrVgkhtztAIQ5AovygF7ocTt/oxa:aQ0/LTrB/KcDMnByVgkLztnaygF8g/r

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks