General

  • Target

    c36f28dad2c639507041650dbaae43ada71d3fae6dd9bbb21957360daba132ce

  • Size

    1.5MB

  • Sample

    241111-ankceaydqb

  • MD5

    768341bd96bd247c9cae7b64465a0565

  • SHA1

    08e53e5b937fb50450cdf5702ac77b67ae44f7d3

  • SHA256

    c36f28dad2c639507041650dbaae43ada71d3fae6dd9bbb21957360daba132ce

  • SHA512

    c6b765dfc5f5f036b938cfb7a9f54249ac7d9df06e6a2be9e0f557957bd71a0d5037084b65627f339fa7429dd75d8e969c33ed8018920e45546bedbe49c2c938

  • SSDEEP

    49152:GepqOoiOwl21pdaL+EgwyI9KsgIPf4GjhE:5qZiOE21q9bPf4GdE

Malware Config

Extracted

Family

redline

Botnet

SUBZERO

C2

185.215.113.217:19618

Attributes
  • auth_value

    019ff2a82025cde517e4466362191205

Targets

    • Target

      c36f28dad2c639507041650dbaae43ada71d3fae6dd9bbb21957360daba132ce

    • Size

      1.5MB

    • MD5

      768341bd96bd247c9cae7b64465a0565

    • SHA1

      08e53e5b937fb50450cdf5702ac77b67ae44f7d3

    • SHA256

      c36f28dad2c639507041650dbaae43ada71d3fae6dd9bbb21957360daba132ce

    • SHA512

      c6b765dfc5f5f036b938cfb7a9f54249ac7d9df06e6a2be9e0f557957bd71a0d5037084b65627f339fa7429dd75d8e969c33ed8018920e45546bedbe49c2c938

    • SSDEEP

      49152:GepqOoiOwl21pdaL+EgwyI9KsgIPf4GjhE:5qZiOE21q9bPf4GdE

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks