General

  • Target

    Adobe.exe

  • Size

    1.2MB

  • Sample

    230131-pwejfsgc52

  • MD5

    a13821ca38de4c4967587323c42ef684

  • SHA1

    1623c9de5259537ec3787633c66c220f96190c50

  • SHA256

    1d4a0580be6b2711dd97bf8313dfd53b1168b16bb8645875c7118b536675f7ff

  • SHA512

    f956668df44f96806a2ad8be221981dfa011b23709682d405e8f71db3f3b09ceb26f4e22ce0dc6f4ee8ea9102b2bf5c25430d502f0b4aed9fe1c024680a60e7f

  • SSDEEP

    24576:hxBVEe/oZNm1Fq5z0HS51Y9hrlFLRsmk:hDGgoZNm1Q5t5C9HZR

Malware Config

Extracted

Family

redline

Botnet

12-09

C2

20.100.11.120:6677

Attributes
  • auth_value

    38c6d2413e326e9d8e1400bf99ea6f85

Targets

    • Target

      Adobe.exe

    • Size

      1.2MB

    • MD5

      a13821ca38de4c4967587323c42ef684

    • SHA1

      1623c9de5259537ec3787633c66c220f96190c50

    • SHA256

      1d4a0580be6b2711dd97bf8313dfd53b1168b16bb8645875c7118b536675f7ff

    • SHA512

      f956668df44f96806a2ad8be221981dfa011b23709682d405e8f71db3f3b09ceb26f4e22ce0dc6f4ee8ea9102b2bf5c25430d502f0b4aed9fe1c024680a60e7f

    • SSDEEP

      24576:hxBVEe/oZNm1Fq5z0HS51Y9hrlFLRsmk:hDGgoZNm1Q5t5C9HZR

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks