General

  • Target

    b8b363fd65b199deca3dd9431534b441c1b526bbe203accff887ed1b323bec54

  • Size

    318KB

  • Sample

    241111-c5keva1ejc

  • MD5

    87865c4e26b98aa1ce20812cd85f73e7

  • SHA1

    2a4b9d825a33e2fed2e470affa2bef291778168b

  • SHA256

    b8b363fd65b199deca3dd9431534b441c1b526bbe203accff887ed1b323bec54

  • SHA512

    bf64b376a0691ee429b893a379c2f3ac8c31c4e9b23ac7c427a594fd7f7faca860e1f9d0ecad1b6096b46170dd038f6d6d1cbf344ebcd56e98e1c891951d44ad

  • SSDEEP

    6144:RD5Wct9ndr8glztAlvJEUvwpnp0Gjrk03RGUUh:XWct9ndr82qJEIap0G8uGbh

Malware Config

Extracted

Family

redline

Botnet

nitro

C2

83.97.73.127:19045

Attributes
  • auth_value

    1b68cf84b9b046f28b71cb39e44aa0e4

Targets

    • Target

      b8b363fd65b199deca3dd9431534b441c1b526bbe203accff887ed1b323bec54

    • Size

      318KB

    • MD5

      87865c4e26b98aa1ce20812cd85f73e7

    • SHA1

      2a4b9d825a33e2fed2e470affa2bef291778168b

    • SHA256

      b8b363fd65b199deca3dd9431534b441c1b526bbe203accff887ed1b323bec54

    • SHA512

      bf64b376a0691ee429b893a379c2f3ac8c31c4e9b23ac7c427a594fd7f7faca860e1f9d0ecad1b6096b46170dd038f6d6d1cbf344ebcd56e98e1c891951d44ad

    • SSDEEP

      6144:RD5Wct9ndr8glztAlvJEUvwpnp0Gjrk03RGUUh:XWct9ndr82qJEIap0G8uGbh

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks