General

  • Target

    modest-menu.exe

  • Size

    272KB

  • Sample

    230312-ebl3paee8x

  • MD5

    1a1c3d59d98acae1cbb61d7684f23630

  • SHA1

    c460bb203135a1501ed262ad0942e31e00b120c1

  • SHA256

    78a85115cf45f7aa9a78d2c858b38901f62c912372dd8fe02d9fc1d157d51b0d

  • SHA512

    0325bed426b96d57ea0820fb444e21f726b486cf9bebc10573d5c0bd917cf070c38472329eb07357f885e280b22b0b7d13f29dc17e73c133671b91f4df29b680

  • SSDEEP

    3072:Z3+SWzM3wrqc306QxK7JylrH4omPLRGy/0hUK17jfTQBT+JXbtGaktN2cCej9OTv:Z3+SWzM36k6QxunBmwilBGR/9a+IB

Malware Config

Extracted

Family

redline

C2

45.15.157.131:36457

Attributes
  • auth_value

    e2b8fca520cd9a12cc348212c33d4ea6

Targets

    • Target

      modest-menu.exe

    • Size

      272KB

    • MD5

      1a1c3d59d98acae1cbb61d7684f23630

    • SHA1

      c460bb203135a1501ed262ad0942e31e00b120c1

    • SHA256

      78a85115cf45f7aa9a78d2c858b38901f62c912372dd8fe02d9fc1d157d51b0d

    • SHA512

      0325bed426b96d57ea0820fb444e21f726b486cf9bebc10573d5c0bd917cf070c38472329eb07357f885e280b22b0b7d13f29dc17e73c133671b91f4df29b680

    • SSDEEP

      3072:Z3+SWzM3wrqc306QxK7JylrH4omPLRGy/0hUK17jfTQBT+JXbtGaktN2cCej9OTv:Z3+SWzM36k6QxunBmwilBGR/9a+IB

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks