General

  • Target

    66e1f5c602e1e72033adf8f2b73568af6a37dcce3027a23ec3b9586b56f7f6e8

  • Size

    247KB

  • Sample

    241111-hga46atpgy

  • MD5

    13cb0fcaa29d3310168adc3d50faf09f

  • SHA1

    b8b48f06df9d22dc94a446146ee20758a2a4809b

  • SHA256

    66e1f5c602e1e72033adf8f2b73568af6a37dcce3027a23ec3b9586b56f7f6e8

  • SHA512

    6ce39098ca7d14208977919429afabd950143e414551fc96b70f543b1f2848deeda3a39d43c628dbeebbc56f54d4156329e3667c72920bf38676e58be4af4b14

  • SSDEEP

    6144:04CAk0rrLUMHfAJM8Gj2IfsT6m6oEN5YA/Fpj9dmyeCkuI:04CAkeAJshfsT6Po4TdmnCkuI

Malware Config

Extracted

Family

redline

Botnet

Google2

C2

167.235.71.14:20469

Attributes
  • auth_value

    fb274d9691235ba015830da570a13578

Targets

    • Target

      66e1f5c602e1e72033adf8f2b73568af6a37dcce3027a23ec3b9586b56f7f6e8

    • Size

      247KB

    • MD5

      13cb0fcaa29d3310168adc3d50faf09f

    • SHA1

      b8b48f06df9d22dc94a446146ee20758a2a4809b

    • SHA256

      66e1f5c602e1e72033adf8f2b73568af6a37dcce3027a23ec3b9586b56f7f6e8

    • SHA512

      6ce39098ca7d14208977919429afabd950143e414551fc96b70f543b1f2848deeda3a39d43c628dbeebbc56f54d4156329e3667c72920bf38676e58be4af4b14

    • SSDEEP

      6144:04CAk0rrLUMHfAJM8Gj2IfsT6m6oEN5YA/Fpj9dmyeCkuI:04CAkeAJshfsT6Po4TdmnCkuI

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks