General

  • Target

    NEAS.e224785c3c825e3c45cf59cac9d62d00.exe

  • Size

    1.1MB

  • Sample

    231028-y2g17sca61

  • MD5

    e224785c3c825e3c45cf59cac9d62d00

  • SHA1

    e27cdc82e8955c8926523d3f2669f485a4d69670

  • SHA256

    8f469b226ef2caa9193de6fc5bfc35d51d4b9d28e907a13442491167d2686654

  • SHA512

    70822471a415dc68ab81cae7b4dbdf92bf5436bc424573bb75bd6178cd7ac5f94212000894ec862720003a03b1eb562556e24a161488f7c0447ac2599f6587e4

  • SSDEEP

    24576:5SILs3Gv5W1TxGQcQkX4OkHpzUw2j4mukOZWh5MBq:5tBWTxGQcQi4OnwWIZWP+

Malware Config

Extracted

Family

redline

Botnet

grome

C2

77.91.124.86:19084

Targets

    • Target

      NEAS.e224785c3c825e3c45cf59cac9d62d00.exe

    • Size

      1.1MB

    • MD5

      e224785c3c825e3c45cf59cac9d62d00

    • SHA1

      e27cdc82e8955c8926523d3f2669f485a4d69670

    • SHA256

      8f469b226ef2caa9193de6fc5bfc35d51d4b9d28e907a13442491167d2686654

    • SHA512

      70822471a415dc68ab81cae7b4dbdf92bf5436bc424573bb75bd6178cd7ac5f94212000894ec862720003a03b1eb562556e24a161488f7c0447ac2599f6587e4

    • SSDEEP

      24576:5SILs3Gv5W1TxGQcQkX4OkHpzUw2j4mukOZWh5MBq:5tBWTxGQcQi4OnwWIZWP+

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks