General

  • Target

    e2fa590001fba01014179e7ce2e9a92f.bin.exe

  • Size

    1.2MB

  • Sample

    230308-qdjk5abd3w

  • MD5

    e2fa590001fba01014179e7ce2e9a92f

  • SHA1

    c44fd95e1f5ba0783909d25e23eeca4d9cb0318e

  • SHA256

    fec0f46a728f0b1906b753eb5e294203a820e06caa4c44d03b8cdbb50a47f840

  • SHA512

    ab18c6987059d57b4208a7731efae5bb6d7b3ed4fb2937d4f89095db1604ca8a8b7dca42c66e4d7a6520f3a2c2b265575bf07116f5a7033941d0955acea7e31c

  • SSDEEP

    6144:cHRCtw93p7Xdxmq8dAAO3L+ZqHqtqxUAk+ENKOzDC:cHkm9ZLLtyAk7C

Malware Config

Extracted

Family

redline

Botnet

TIGER2

C2

20.81.209.75:80

Attributes
  • auth_value

    82a234222f045599c3ff3c71c7aaebab

Targets

    • Target

      e2fa590001fba01014179e7ce2e9a92f.bin.exe

    • Size

      1.2MB

    • MD5

      e2fa590001fba01014179e7ce2e9a92f

    • SHA1

      c44fd95e1f5ba0783909d25e23eeca4d9cb0318e

    • SHA256

      fec0f46a728f0b1906b753eb5e294203a820e06caa4c44d03b8cdbb50a47f840

    • SHA512

      ab18c6987059d57b4208a7731efae5bb6d7b3ed4fb2937d4f89095db1604ca8a8b7dca42c66e4d7a6520f3a2c2b265575bf07116f5a7033941d0955acea7e31c

    • SSDEEP

      6144:cHRCtw93p7Xdxmq8dAAO3L+ZqHqtqxUAk+ENKOzDC:cHkm9ZLLtyAk7C

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks