General

  • Target

    d56c6f8427fce731181a5472e8f2c1d01f3bd7da

  • Size

    292KB

  • Sample

    241111-cgwszazhna

  • MD5

    224897f785ed7dc110d24a0481135cc9

  • SHA1

    d56c6f8427fce731181a5472e8f2c1d01f3bd7da

  • SHA256

    7a44e9b5edfeabfd3fc3841ad79e90a293c7c953013b0bf2925814814724849d

  • SHA512

    cf4ba62274001c5b1b215153bba94c3891abe33c32299dd629d4a097a2742260e8733636fc4f1a2c9b2a8734531bfd9026d1000b5ad9b5969b8ba6b656f6e6d3

  • SSDEEP

    6144:i2vyHvIulvDFsNGIJgrW07AO1RV7JX27witJ1:i26HvIulv5b7vRV7JBMJ

Malware Config

Extracted

Family

redline

Botnet

nam5

C2

103.89.90.61:34589

Attributes
  • auth_value

    543e073674533e6c674abb1adba6e5c7

Targets

    • Target

      d56c6f8427fce731181a5472e8f2c1d01f3bd7da

    • Size

      292KB

    • MD5

      224897f785ed7dc110d24a0481135cc9

    • SHA1

      d56c6f8427fce731181a5472e8f2c1d01f3bd7da

    • SHA256

      7a44e9b5edfeabfd3fc3841ad79e90a293c7c953013b0bf2925814814724849d

    • SHA512

      cf4ba62274001c5b1b215153bba94c3891abe33c32299dd629d4a097a2742260e8733636fc4f1a2c9b2a8734531bfd9026d1000b5ad9b5969b8ba6b656f6e6d3

    • SSDEEP

      6144:i2vyHvIulvDFsNGIJgrW07AO1RV7JX27witJ1:i26HvIulv5b7vRV7JBMJ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks