General

  • Target

    Installer.exe

  • Size

    250KB

  • Sample

    230322-k3wdbsfh88

  • MD5

    02b87d3f53c5cbdc2c18cc6c0e6836d8

  • SHA1

    ccc7236e49f8bf1e437fcc9ec9539d9bb78b6f3f

  • SHA256

    c7d7fe67014e4b96abd6b5215ade5a86ba18abeca44cd6416586d142281a2b7a

  • SHA512

    79fcc8954851d94f2e63dc9adba4de396f06325e4ca40892873214cf04467195dac37c3ce8dc3eb877875692b2b1d4b2de850614d2e8a73fc5b960300af05ea7

  • SSDEEP

    6144:GTaVWjAfT2UEfO2uwPlyR3EsGY/uyRvm4UPV:oaVWjeIfOJR3EsGYWyBs

Malware Config

Extracted

Family

redline

Botnet

@Qup1x

C2

45.15.156.155:80

Attributes
  • auth_value

    09785267dffbe1103f18cf1d089a98e3

Targets

    • Target

      Installer.exe

    • Size

      250KB

    • MD5

      02b87d3f53c5cbdc2c18cc6c0e6836d8

    • SHA1

      ccc7236e49f8bf1e437fcc9ec9539d9bb78b6f3f

    • SHA256

      c7d7fe67014e4b96abd6b5215ade5a86ba18abeca44cd6416586d142281a2b7a

    • SHA512

      79fcc8954851d94f2e63dc9adba4de396f06325e4ca40892873214cf04467195dac37c3ce8dc3eb877875692b2b1d4b2de850614d2e8a73fc5b960300af05ea7

    • SSDEEP

      6144:GTaVWjAfT2UEfO2uwPlyR3EsGY/uyRvm4UPV:oaVWjeIfOJR3EsGYWyBs

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks