General

  • Target

    9db696d411e33a3a68db18b8a1680112.bin

  • Size

    3KB

  • Sample

    240505-bzcx5sdf77

  • MD5

    ae4369c86944bc13d8d212ae645d6c35

  • SHA1

    d26db427ed1fe3bea46dc155eab26eb482b3e046

  • SHA256

    1237c7c7bcd03e44efe6d3d1b7d238ca208e39e13ab61c0f6e53495a8e337bbb

  • SHA512

    b42caca9e864982b98701ce0f8a1489db4697dca371d8e6e82d0fe763aae63d35aae3fd54931564f74e15acb720a380e0105ab11ee604c2560a919c511d6ae0a

Malware Config

Extracted

Family

redline

Botnet

murder - first build

C2

109.120.178.235:26632

Targets

    • Target

      94f46a73df32470400d1fc25336146155321a04c4eec0f40cb8527db702499e3.exe

    • Size

      7KB

    • MD5

      9db696d411e33a3a68db18b8a1680112

    • SHA1

      8ad3f5f7730ba7db2b656b3ea080e743115980e4

    • SHA256

      94f46a73df32470400d1fc25336146155321a04c4eec0f40cb8527db702499e3

    • SHA512

      c998e1070f4375121cbfc0bbf8421db5f5ef9891edb5610d4d50fcbd5222d0f33121f38b72730d038d63e092f24067b5b74b5c59b31cdcd97364c0812d08951b

    • SSDEEP

      96:bz7UDyrF4xhsty0BoaJt+lYn5euWY+tn4XgPPH6My3JK2VOf2dfeazNt:PSuF8hsty0qUt+lUeuHO+gn6My4q1

    • Detect ZGRat V1

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks