General

  • Target

    aa575e3222cee5268133de409889b5c0

  • Size

    749KB

  • Sample

    241109-m7gf3sslh1

  • MD5

    aa575e3222cee5268133de409889b5c0

  • SHA1

    b9eba413174296a4ff9f5008d6beb27a4e543780

  • SHA256

    b29e7e9d65747fa41deb22ac1487c780c6acb106d009f7e75835f60547ec2c36

  • SHA512

    0b4ce7c0266710c919fcb43d254d16d9e5a54aeeb2289fdd99cdeaad9e00b3b266d2a30b6a6d7ca741ac7b23b5595fc73843732c814271419454f4b9cadb14da

  • SSDEEP

    12288:aPieeUlkzFsMplL/QfZpLFQa0RRZJ58ZShXz4xoW29Lj8C6GJ7GjvlPYH1eGnKYD:a6E4FDlLQn0ZD84pz4oXHT6GJqzS8BPE

Malware Config

Extracted

Family

redline

Botnet

1310

C2

79.137.192.57:48771

Attributes
  • auth_value

    feb5f5c29913f32658637e553762a40e

Targets

    • Target

      98999d2d726981c9f225d175dddc5c9a9c98a7b9716fe517d158c1cfdfcbc6fc

    • Size

      2.6MB

    • MD5

      e251d4a4fc7fd8628573e6f0e8c946e3

    • SHA1

      db0745fd48ef2ba8b07986356d27fd2c54292d09

    • SHA256

      98999d2d726981c9f225d175dddc5c9a9c98a7b9716fe517d158c1cfdfcbc6fc

    • SHA512

      a69e3bbbeb0f9835ef0a51a34b72551c5e913f1e2a97eec78ad9345d9e1b4b352e0a8d26f2744ded94cd94b43edf2ce3832b382d15272ecdd1e1bdf4d716286f

    • SSDEEP

      24576:OryZxbMZfJ71qlWsxp4cpYOYVqAk/bdM2rAyx+dolv6ZGPHPAGLY/r6TqCnAoWSH:IyZtscp4afPHPqrA1AoWSkS+Tl3Q

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks