General

  • Target

    31e477a3732cf4d377bbb89c5a5a3763dadd3581ce07534bb4fc54efb951823b

  • Size

    1.3MB

  • Sample

    230226-hjpekafh7w

  • MD5

    2d046356adc419adef4049f5ec0529fa

  • SHA1

    59b79b81155927260c7e5c73c1505b7ff820fcd7

  • SHA256

    31e477a3732cf4d377bbb89c5a5a3763dadd3581ce07534bb4fc54efb951823b

  • SHA512

    118b6af39c3107785695e61b050a2d767a86f6efe42c7c2afec0f49b651ba318d7a8d783aa7c12936d2aa5a93e4d34e39944e3587dd90dbe36a719ac18e36297

  • SSDEEP

    24576:FfEZRk+1BmMN+wkQZVhtMOb7UlyPeNks08yfcadLetM7ckAx:Ff3IcMNHRLF4yP8k+y5UYnc

Malware Config

Extracted

Family

redline

Botnet

Z2K

C2

amrican-sport-live-stream.cc:4581

Attributes
  • auth_value

    8a9de6d1ef98f81da5a7e46825e88077

Targets

    • Target

      31e477a3732cf4d377bbb89c5a5a3763dadd3581ce07534bb4fc54efb951823b

    • Size

      1.3MB

    • MD5

      2d046356adc419adef4049f5ec0529fa

    • SHA1

      59b79b81155927260c7e5c73c1505b7ff820fcd7

    • SHA256

      31e477a3732cf4d377bbb89c5a5a3763dadd3581ce07534bb4fc54efb951823b

    • SHA512

      118b6af39c3107785695e61b050a2d767a86f6efe42c7c2afec0f49b651ba318d7a8d783aa7c12936d2aa5a93e4d34e39944e3587dd90dbe36a719ac18e36297

    • SSDEEP

      24576:FfEZRk+1BmMN+wkQZVhtMOb7UlyPeNks08yfcadLetM7ckAx:Ff3IcMNHRLF4yP8k+y5UYnc

    • Detect PureCrypter injector

    • PureCrypter

      PureCrypter is a .NET malware loader first seen in early 2021.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks