redline | ead2696dfe7bfab2b66e6f9e481202e6d9b0630f06e29133c1348fb53e67c479 | Triage

Sharing

General

Target

111fff9fbfee168e67c144814c1c7190_NeikiAnalytics.exe
Size

91KB
Sample

240527-ayxeqaah28
MD5

111fff9fbfee168e67c144814c1c7190
SHA1

612f7c72f58938d4919fb31d23b12ad9f3f777b7
SHA256

ead2696dfe7bfab2b66e6f9e481202e6d9b0630f06e29133c1348fb53e67c479
SHA512

f9ada9adf8a48974804f311f7bce061db6262b4b77da664085a22b2d4d103ab02e7cc77f484e2561d7ff1459cdc289b4b39679395d73c9003b49899b3672f2e6
SSDEEP

1536:PuU4TpvSpjsLZQEU4WcILxdtylKdNHtO8LnbrUMKGMc/A/IzKVqk/6xI/oswZx01:juapjsLyEU4WcILg8LbZnMc/QIzKVqk7

Score

10^/10

redline 1276259125_99 microsoft phishing

Malware Config

Extracted

Family

redline

Botnet

1276259125_99

C2

cocomarket.win:3306

cocomarket.win:28786

Attributes

auth_value
02be53c526bf739e87f7da178393f0d9

Targets

- Target
  
  111fff9fbfee168e67c144814c1c7190_NeikiAnalytics.exe
- Size
  
  91KB
- MD5
  
  111fff9fbfee168e67c144814c1c7190
- SHA1
  
  612f7c72f58938d4919fb31d23b12ad9f3f777b7
- SHA256
  
  ead2696dfe7bfab2b66e6f9e481202e6d9b0630f06e29133c1348fb53e67c479
- SHA512
  
  f9ada9adf8a48974804f311f7bce061db6262b4b77da664085a22b2d4d103ab02e7cc77f484e2561d7ff1459cdc289b4b39679395d73c9003b49899b3672f2e6
- SSDEEP
  
  1536:PuU4TpvSpjsLZQEU4WcILxdtylKdNHtO8LnbrUMKGMc/A/IzKVqk/6xI/oswZx01:juapjsLyEU4WcILg8LbZnMc/QIzKVqk7
Score

5^/10

microsoft phishing
- Detected potential entity reuse from brand microsoft.
  phishing microsoft
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

1276259125_99redline

behavioral1

behavioral2

microsoftphishing