General

  • Target

    bdcab1bf5a4cf8188032c74451814fb5.exe

  • Size

    338KB

  • Sample

    230329-t9z5jaag2w

  • MD5

    bdcab1bf5a4cf8188032c74451814fb5

  • SHA1

    032c229f562b28c60959bc3330188eb8b9f48704

  • SHA256

    826c0ad3560a00bb95697992f9be32d689a6b64fa1f8c15624f4609690b641af

  • SHA512

    1b97dd52fe7b6c98eed777ffb86f53dd05b879dec35b1662213d6a163a64a5815c37120443b0e50b19b62729670ebb2f666c61ae25edd1e819ef3cbab94152ce

  • SSDEEP

    6144:PAEkhcG/ZiMf1KIY+am1ioj02HY7HqpxTacZL7:YrhBA+H1ilT7Hexmcd7

Malware Config

Extracted

Family

redline

Botnet

654

C2

185.65.105.60:10805

Attributes
  • auth_value

    762122531dcf2a6fba95431c415e85cb

Targets

    • Target

      bdcab1bf5a4cf8188032c74451814fb5.exe

    • Size

      338KB

    • MD5

      bdcab1bf5a4cf8188032c74451814fb5

    • SHA1

      032c229f562b28c60959bc3330188eb8b9f48704

    • SHA256

      826c0ad3560a00bb95697992f9be32d689a6b64fa1f8c15624f4609690b641af

    • SHA512

      1b97dd52fe7b6c98eed777ffb86f53dd05b879dec35b1662213d6a163a64a5815c37120443b0e50b19b62729670ebb2f666c61ae25edd1e819ef3cbab94152ce

    • SSDEEP

      6144:PAEkhcG/ZiMf1KIY+am1ioj02HY7HqpxTacZL7:YrhBA+H1ilT7Hexmcd7

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks