General

  • Target

    c40281fd71f4ecd008078f1c2bbe08ebc19780f160319208508f8fb65feef2f7

  • Size

    341KB

  • Sample

    241111-ad953sxhlq

  • MD5

    a4f41775eb654b7770adb4fbce5d955f

  • SHA1

    018730dfb9b194995622d5f324aa52472ea4991d

  • SHA256

    c40281fd71f4ecd008078f1c2bbe08ebc19780f160319208508f8fb65feef2f7

  • SHA512

    5b38bebf4f22d3099f781ca786bf8a8c7b2bd274f57a0ac912b96d6772a76a25e07f893ce67652b02896f79404465d242b2c8e8b3caae143fa9ef62784bc1539

  • SSDEEP

    6144:hENSoxO8wZfJvsje83ri7p9JbUIMAOwe0UPB33ovcMK6ttAqPkSTaVyd:+/O8wZfJvBbdMTPpo/K6ttAqPNOId

Malware Config

Extracted

Family

redline

Botnet

slovarikinstalls

C2

78.153.144.3:2510

Attributes
  • auth_value

    5f80b2ec82e3bd02a08a3a55d3180551

Targets

    • Target

      c40281fd71f4ecd008078f1c2bbe08ebc19780f160319208508f8fb65feef2f7

    • Size

      341KB

    • MD5

      a4f41775eb654b7770adb4fbce5d955f

    • SHA1

      018730dfb9b194995622d5f324aa52472ea4991d

    • SHA256

      c40281fd71f4ecd008078f1c2bbe08ebc19780f160319208508f8fb65feef2f7

    • SHA512

      5b38bebf4f22d3099f781ca786bf8a8c7b2bd274f57a0ac912b96d6772a76a25e07f893ce67652b02896f79404465d242b2c8e8b3caae143fa9ef62784bc1539

    • SSDEEP

      6144:hENSoxO8wZfJvsje83ri7p9JbUIMAOwe0UPB33ovcMK6ttAqPkSTaVyd:+/O8wZfJvBbdMTPpo/K6ttAqPNOId

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks