General

  • Target

    i1644011.exe

  • Size

    304KB

  • Sample

    230604-fw1bgsbc32

  • MD5

    2f6ea5b99ca33f4951938f8fe3ac478d

  • SHA1

    8068319d2cb1d79196b73e65f1841202d0d99100

  • SHA256

    88dbdd424e655c1a6f39fbd916138b953987ccabcb22babf0382e5eab7782839

  • SHA512

    3fc91a75978b3cfe2a9473703aa9a1a375890a9f6307953b708013af53045e652684fa35475bfdff2c0745043194635606b2e4e2c84421d12ee93a5eefe14452

  • SSDEEP

    6144:7rRCtFmE8QxL0SYZ3gOkB4XreVyDuAPN9/Qewn3tPlEKsgGE:pCtF0rekDuA1JuHIgp

Malware Config

Extracted

Family

redline

Botnet

brain

C2

83.97.73.126:19046

Attributes
  • auth_value

    5fb8269baadec0c49899b9a7a0c8851f

Targets

    • Target

      i1644011.exe

    • Size

      304KB

    • MD5

      2f6ea5b99ca33f4951938f8fe3ac478d

    • SHA1

      8068319d2cb1d79196b73e65f1841202d0d99100

    • SHA256

      88dbdd424e655c1a6f39fbd916138b953987ccabcb22babf0382e5eab7782839

    • SHA512

      3fc91a75978b3cfe2a9473703aa9a1a375890a9f6307953b708013af53045e652684fa35475bfdff2c0745043194635606b2e4e2c84421d12ee93a5eefe14452

    • SSDEEP

      6144:7rRCtFmE8QxL0SYZ3gOkB4XreVyDuAPN9/Qewn3tPlEKsgGE:pCtF0rekDuA1JuHIgp

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks