General

  • Target

    NEAS.9271d4ca194ff3cfbf8bd13272166470.exe

  • Size

    1.1MB

  • Sample

    231014-wpmd2sdb4y

  • MD5

    9271d4ca194ff3cfbf8bd13272166470

  • SHA1

    e44b869c51b07fa5e98ffe05bc1124e83c60c839

  • SHA256

    137773187f39738924c9f873b879d0a8432dd96b7e30f9681340599b08233ae8

  • SHA512

    c4ca5955a983ca58c88171551c834c710ba2673c963a1978346d5d3c2108cd3449e7dd91cf1ef32da29000b99ed9ac80f069004fe4e2a829b6d2f200bd688273

  • SSDEEP

    12288:T0xJ1c9psKtwW7IhuOXUPJuI85i8gTohuVoh3zGJYbn1bhzTm0:Te1c9psKtwW7m3iM5i8VnzQ0B

Malware Config

Extracted

Family

redline

Botnet

breha

C2

77.91.124.55:19071

Targets

    • Target

      NEAS.9271d4ca194ff3cfbf8bd13272166470.exe

    • Size

      1.1MB

    • MD5

      9271d4ca194ff3cfbf8bd13272166470

    • SHA1

      e44b869c51b07fa5e98ffe05bc1124e83c60c839

    • SHA256

      137773187f39738924c9f873b879d0a8432dd96b7e30f9681340599b08233ae8

    • SHA512

      c4ca5955a983ca58c88171551c834c710ba2673c963a1978346d5d3c2108cd3449e7dd91cf1ef32da29000b99ed9ac80f069004fe4e2a829b6d2f200bd688273

    • SSDEEP

      12288:T0xJ1c9psKtwW7IhuOXUPJuI85i8gTohuVoh3zGJYbn1bhzTm0:Te1c9psKtwW7m3iM5i8VnzQ0B

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks