General

  • Target

    bf6e5b1ebee2a8280a2363a07181bf7071c4753c1677b91d4cf76f5c2b52d336

  • Size

    295KB

  • Sample

    241110-1sm7zawcmj

  • MD5

    238e428318a48089fee95f58891484d1

  • SHA1

    8e4b90c5c9c558ca5f9c47bfb8a5863372bbc733

  • SHA256

    bf6e5b1ebee2a8280a2363a07181bf7071c4753c1677b91d4cf76f5c2b52d336

  • SHA512

    a56fdd0e9c178010c344061439cc1f0378870311c8965821dd384bba4ed5e73a5c1c7eb7a7419899d1b0d28b0027aff6cf69c6c2f9568da7bda59c7037f71916

  • SSDEEP

    6144:K5M8HSslbptGYoVAAOrV+WL5Zdqm0fYGxo/YVUhVsPM:KG8HSslz5V+WBqm0fNY6P

Malware Config

Extracted

Family

redline

Botnet

9-5

C2

139.99.32.83:43199

Attributes
  • auth_value

    637de2b47f42d9cc7912f71cb6b57b5b

Targets

    • Target

      bf6e5b1ebee2a8280a2363a07181bf7071c4753c1677b91d4cf76f5c2b52d336

    • Size

      295KB

    • MD5

      238e428318a48089fee95f58891484d1

    • SHA1

      8e4b90c5c9c558ca5f9c47bfb8a5863372bbc733

    • SHA256

      bf6e5b1ebee2a8280a2363a07181bf7071c4753c1677b91d4cf76f5c2b52d336

    • SHA512

      a56fdd0e9c178010c344061439cc1f0378870311c8965821dd384bba4ed5e73a5c1c7eb7a7419899d1b0d28b0027aff6cf69c6c2f9568da7bda59c7037f71916

    • SSDEEP

      6144:K5M8HSslbptGYoVAAOrV+WL5Zdqm0fYGxo/YVUhVsPM:KG8HSslz5V+WBqm0fNY6P

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks