General

  • Target

    7d53a78fb456316fe4380193b6b6e3f4daf95f88279aa584c871102157345407N.exe

  • Size

    904KB

  • Sample

    241119-nph3mavgkc

  • MD5

    29b747e9416ba9e264c5a5b6881696a0

  • SHA1

    22f867009fc2382b271d9eb83f57a435f6f19457

  • SHA256

    7d53a78fb456316fe4380193b6b6e3f4daf95f88279aa584c871102157345407

  • SHA512

    acae2275f68efa078ed7e22dd0d1efb4d2ffcbd06403cb2a2355c8e136ce6d770b42492f3c44d16c09f99c3a5f97a7584dcb1e0a5981b14842139967c043d754

  • SSDEEP

    12288:L5JAhP+GQaRKCI19VcH03kiBkqiNRBrDdWZJb2xFKBLnssz4p5m7UC4gWjZnGLxR:L5J7ERKe0rBkzbqh3

Malware Config

Extracted

Family

redline

Botnet

joana

C2

185.161.248.75:4132

Attributes
  • auth_value

    85090ed112d639bb782481da2912487a

Targets

    • Target

      7d53a78fb456316fe4380193b6b6e3f4daf95f88279aa584c871102157345407N.exe

    • Size

      904KB

    • MD5

      29b747e9416ba9e264c5a5b6881696a0

    • SHA1

      22f867009fc2382b271d9eb83f57a435f6f19457

    • SHA256

      7d53a78fb456316fe4380193b6b6e3f4daf95f88279aa584c871102157345407

    • SHA512

      acae2275f68efa078ed7e22dd0d1efb4d2ffcbd06403cb2a2355c8e136ce6d770b42492f3c44d16c09f99c3a5f97a7584dcb1e0a5981b14842139967c043d754

    • SSDEEP

      12288:L5JAhP+GQaRKCI19VcH03kiBkqiNRBrDdWZJb2xFKBLnssz4p5m7UC4gWjZnGLxR:L5J7ERKe0rBkzbqh3

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks