General

  • Target

    9f0d2379f560c77ef1627b592e271ff2eb38ce08e7a5ec7584e56e09472d4b3e

  • Size

    1.6MB

  • Sample

    241111-b9a7asyqbz

  • MD5

    50e29edfad0fbedaa4c9b7e72c808c70

  • SHA1

    0e890d91d6ce3d16f83dda260910a7a4afa570fd

  • SHA256

    9f0d2379f560c77ef1627b592e271ff2eb38ce08e7a5ec7584e56e09472d4b3e

  • SHA512

    572c6940988e0398bd089c79d9febf34886771913ac94ca066337fa9f8f2fe03b032ebbd246219d691ad9f7ce15aa3ca9e293805fee3bf62c8fe9aac979158f8

  • SSDEEP

    24576:wmcwmhViqgItnLoI23EnF3T9Fa4hkH5HRQkOGc4RsT9qXLuQaM7UUbKQGsd:wEWLol3EnF3T9Fa4hK5/oQXLuYBPVd

Malware Config

Extracted

Family

redline

Botnet

SUBZERO

C2

185.215.113.217:19618

Attributes
  • auth_value

    019ff2a82025cde517e4466362191205

Targets

    • Target

      9f0d2379f560c77ef1627b592e271ff2eb38ce08e7a5ec7584e56e09472d4b3e

    • Size

      1.6MB

    • MD5

      50e29edfad0fbedaa4c9b7e72c808c70

    • SHA1

      0e890d91d6ce3d16f83dda260910a7a4afa570fd

    • SHA256

      9f0d2379f560c77ef1627b592e271ff2eb38ce08e7a5ec7584e56e09472d4b3e

    • SHA512

      572c6940988e0398bd089c79d9febf34886771913ac94ca066337fa9f8f2fe03b032ebbd246219d691ad9f7ce15aa3ca9e293805fee3bf62c8fe9aac979158f8

    • SSDEEP

      24576:wmcwmhViqgItnLoI23EnF3T9Fa4hkH5HRQkOGc4RsT9qXLuQaM7UUbKQGsd:wEWLol3EnF3T9Fa4hK5/oQXLuYBPVd

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks