General

  • Target

    d5acb2ef686a1777115b331df661aaf9cbf999f3dd13b7bd0f4d8c65098d0a07

  • Size

    319KB

  • Sample

    241111-czgf1atpbp

  • MD5

    fb573bdb3905fb64d15d99cb3af6986a

  • SHA1

    ef295102756aadf6ec0a10a4c1d7ad386e55e9fa

  • SHA256

    d5acb2ef686a1777115b331df661aaf9cbf999f3dd13b7bd0f4d8c65098d0a07

  • SHA512

    5fefe413672dc337d53d471687629156472d8e47c966e08cee085f50d6c73bb64a634643a26ea8f87b8dee949b406dd066aae073d54e4bb1b84506db13fcf1f4

  • SSDEEP

    6144:KwvLTg1U3vdznN2ZEpeipw6xcU9peX2ZgAPPsyX8cXB:K8AwvdNUUxxemZPPs25B

Malware Config

Extracted

Family

redline

Botnet

@chicago

C2

185.11.61.125:22344

Attributes
  • auth_value

    21f863e0cbd09d0681058e068d0d1d7f

Targets

    • Target

      d5acb2ef686a1777115b331df661aaf9cbf999f3dd13b7bd0f4d8c65098d0a07

    • Size

      319KB

    • MD5

      fb573bdb3905fb64d15d99cb3af6986a

    • SHA1

      ef295102756aadf6ec0a10a4c1d7ad386e55e9fa

    • SHA256

      d5acb2ef686a1777115b331df661aaf9cbf999f3dd13b7bd0f4d8c65098d0a07

    • SHA512

      5fefe413672dc337d53d471687629156472d8e47c966e08cee085f50d6c73bb64a634643a26ea8f87b8dee949b406dd066aae073d54e4bb1b84506db13fcf1f4

    • SSDEEP

      6144:KwvLTg1U3vdznN2ZEpeipw6xcU9peX2ZgAPPsyX8cXB:K8AwvdNUUxxemZPPs25B

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks