General

  • Target

    072be0734cd0581ff396918e854786fa2db17b086a06595e5b6418e80dc331de.exe

  • Size

    2.3MB

  • Sample

    240706-g99mra1fma

  • MD5

    1eb29fab9f8aa23ffd3de7cc20af03fd

  • SHA1

    55240155e013abb7cf076d3b9629137bac6c23d0

  • SHA256

    072be0734cd0581ff396918e854786fa2db17b086a06595e5b6418e80dc331de

  • SHA512

    736178980a7cfe902a7a48613b7768cf1f4bebc610e72872162b103716ee460b3bb7019a6a1101cf2f7a1c407277d904892351d6fe3067d32cfd7d2baade0bd4

  • SSDEEP

    12288:kEmnpQX49TUdEY/s0nCDXS58xHQpg92Yc8tYLJDJtqUQcMb:Ap

Malware Config

Extracted

Family

redline

Botnet

1612335857

C2

https://t.me/+7Lir0e4Gw381MDhi*https://steamcommunity.com/profiles/76561199038841443

Targets

    • Target

      072be0734cd0581ff396918e854786fa2db17b086a06595e5b6418e80dc331de.exe

    • Size

      2.3MB

    • MD5

      1eb29fab9f8aa23ffd3de7cc20af03fd

    • SHA1

      55240155e013abb7cf076d3b9629137bac6c23d0

    • SHA256

      072be0734cd0581ff396918e854786fa2db17b086a06595e5b6418e80dc331de

    • SHA512

      736178980a7cfe902a7a48613b7768cf1f4bebc610e72872162b103716ee460b3bb7019a6a1101cf2f7a1c407277d904892351d6fe3067d32cfd7d2baade0bd4

    • SSDEEP

      12288:kEmnpQX49TUdEY/s0nCDXS58xHQpg92Yc8tYLJDJtqUQcMb:Ap

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks