General

  • Target

    5c73b3783854423bd53b0a0bd6883a1a

  • Size

    760KB

  • Sample

    241111-axsedaxqcx

  • MD5

    5c73b3783854423bd53b0a0bd6883a1a

  • SHA1

    16f0ce8752e60deda18adc51cc5c2706346ad586

  • SHA256

    33d49928127a40b3ec35c63063e40c3d359e88588ca58555cdec903d9c6ca577

  • SHA512

    7f26733baeca56b37731021d715cd121cc0b227047f5e182f88f4081cb4c6fdce1f5b69c666840540df68274632cb8ecf021e4970833106ead655f8146f89ba5

  • SSDEEP

    12288:2BcqGzY8BfYpa9cc/uEZjA3+N8V0ReQL1/VsSEnNamrsR1SK7j8RvzZXuZqaqn5B:26qG8agtEw+i0ReQlinEmrsRKRvzZXwk

Malware Config

Extracted

Family

redline

Botnet

711

C2

194.110.203.100:32796

Attributes
  • auth_value

    24e3340d853c89cad1e25194559ee778

Targets

    • Target

      9a27c02eb672606161359aa7e306c2790b372ffe4e38a058d58e9576d3f47d37.exe

    • Size

      2.6MB

    • MD5

      515f3a2cff497021519d4a0f02062274

    • SHA1

      2df3bb7a9b2ddadc7331c3cd3b0c202ba7b1c1e7

    • SHA256

      9a27c02eb672606161359aa7e306c2790b372ffe4e38a058d58e9576d3f47d37

    • SHA512

      705671ea5c4fcaa353cdfd247ed5fb2e6d9be01242dc7cb65d26702538c7c18cbd19990e6bee997296e600f89297e66bf23338d1a24941de326e60c5752b2008

    • SSDEEP

      24576:skNqIJY0pSAlGTEw5YUY1F2yAuMww6C1dVAt258NImLwqDkAR+Lk8w4/Al3RuQ5B:skNqIJvpSAlSEPjlImLwqDkAR+wvl3L

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks