Resubmissions

16-03-2023 14:45

230316-r4rj4adf2z 10

13-03-2023 21:27

230313-1a286seb7y 7

General

  • Target

    lighter_PayPalChecker.exe

  • Size

    1.3MB

  • Sample

    230316-r4rj4adf2z

  • MD5

    f4efc7d9d46f77d904e46876c50f93ed

  • SHA1

    6f98694c202a5d87304419477cb527140880d977

  • SHA256

    7ff1a83bc10270bf0298e4b483c27bfb0932a0224f472816cc9ffc37378353fe

  • SHA512

    0bf5dd42f25b1e0514ccdf66a3d1ecf37a2bafc51a6d635e1f5d3eae2b1bd2a9983afd972198647ea7ff9897afb7cfd4bf81a9eea63909dd5b4b46248bca70db

  • SSDEEP

    24576:DT6tdEmNLhqOm7Y2nRUvi0IbnLLDprYJOfsPow5ByYghdJ:DTQKQEO+nIDInLtrjf6eBrJ

Malware Config

Extracted

Family

redline

Botnet

sAmArA

C2

49.12.235.231:3471

Attributes
  • auth_value

    a2389fea865575735370ffae6f5be2b5

Targets

    • Target

      lighter_PayPalChecker.exe

    • Size

      1.3MB

    • MD5

      f4efc7d9d46f77d904e46876c50f93ed

    • SHA1

      6f98694c202a5d87304419477cb527140880d977

    • SHA256

      7ff1a83bc10270bf0298e4b483c27bfb0932a0224f472816cc9ffc37378353fe

    • SHA512

      0bf5dd42f25b1e0514ccdf66a3d1ecf37a2bafc51a6d635e1f5d3eae2b1bd2a9983afd972198647ea7ff9897afb7cfd4bf81a9eea63909dd5b4b46248bca70db

    • SSDEEP

      24576:DT6tdEmNLhqOm7Y2nRUvi0IbnLLDprYJOfsPow5ByYghdJ:DTQKQEO+nIDInLtrjf6eBrJ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix

Tasks