General

  • Target

    1d1ba6176bd62061b0b996fabe5908a24fb8c9b47423554b1ce0ef011f715b6a

  • Size

    300KB

  • Sample

    241110-3v57nsxkhs

  • MD5

    055f1c280899149b74b2c8d619b3c161

  • SHA1

    539dd992a3dfbd2abf32e37a34600be43cb9e25b

  • SHA256

    1d1ba6176bd62061b0b996fabe5908a24fb8c9b47423554b1ce0ef011f715b6a

  • SHA512

    4d09c977487dc4f751f2bed4a3088e1a52900a925761a1e6ce19e3a30483111ea5121340c2da5840cc830223c4650e34eb7406cef492029073ae8e50735096f6

  • SSDEEP

    6144:30vyHvIulvDFsNGIJgrW07AO6OnhxuLehS/kLIzy3tJ1t:306HvIulv5b77nhxS/kLH9J7

Malware Config

Extracted

Family

redline

Botnet

nam5

C2

103.89.90.61:34589

Attributes
  • auth_value

    543e073674533e6c674abb1adba6e5c7

Targets

    • Target

      1d1ba6176bd62061b0b996fabe5908a24fb8c9b47423554b1ce0ef011f715b6a

    • Size

      300KB

    • MD5

      055f1c280899149b74b2c8d619b3c161

    • SHA1

      539dd992a3dfbd2abf32e37a34600be43cb9e25b

    • SHA256

      1d1ba6176bd62061b0b996fabe5908a24fb8c9b47423554b1ce0ef011f715b6a

    • SHA512

      4d09c977487dc4f751f2bed4a3088e1a52900a925761a1e6ce19e3a30483111ea5121340c2da5840cc830223c4650e34eb7406cef492029073ae8e50735096f6

    • SSDEEP

      6144:30vyHvIulvDFsNGIJgrW07AO6OnhxuLehS/kLIzy3tJ1t:306HvIulv5b77nhxS/kLH9J7

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks