General

  • Target

    https://mega.nz/file/a1tDEAjJ#3JZZnt-xJSIP74QYyIEOb5jv8Sfdcu5gDFdJJfJQAb8

  • Sample

    240522-nycbfaed22

Malware Config

Extracted

Family

redline

C2

65.108.29.210:21638

Attributes
  • auth_value

    ad39d6a8ea7823f2a92f57ebaa4c98a5

Targets

    • Target

      https://mega.nz/file/a1tDEAjJ#3JZZnt-xJSIP74QYyIEOb5jv8Sfdcu5gDFdJJfJQAb8

    • Gurcu, WhiteSnake

      Gurcu is a malware stealer written in C#.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks