General

  • Target

    d0a6d91de1b3064e62f5a8dc44e29efdf766a33a7ec9d66d7136f3e276b0dd5e.exe

  • Size

    4.6MB

  • Sample

    241120-2t1p5avpcs

  • MD5

    f77d7dc02be06815f1d8169ccbe72858

  • SHA1

    ce015e827f6c9f68a136f8836c5623aff05e8443

  • SHA256

    d0a6d91de1b3064e62f5a8dc44e29efdf766a33a7ec9d66d7136f3e276b0dd5e

  • SHA512

    9dea65a395a5aefcafa30fc141cb44ea4b8c6c286f10b71cccb375f9a0bce1e102653c26543e212d5331610a1c6043625d036e8fd50ffb2b38b30e753ed76d72

  • SSDEEP

    98304:5LXT3b5B8T4O1OiZ/iZHZsonSh1XbiRFqE0c+Jmpm:x52Tz1XZ/iZ5sFriRFt0c+Em

Malware Config

Extracted

Family

redline

Botnet

@EstetikaSell

C2

185.209.22.181:29234

Attributes
  • auth_value

    5a0918bd3e8ede8e02c8dd9d106a996d

Targets

    • Target

      d0a6d91de1b3064e62f5a8dc44e29efdf766a33a7ec9d66d7136f3e276b0dd5e.exe

    • Size

      4.6MB

    • MD5

      f77d7dc02be06815f1d8169ccbe72858

    • SHA1

      ce015e827f6c9f68a136f8836c5623aff05e8443

    • SHA256

      d0a6d91de1b3064e62f5a8dc44e29efdf766a33a7ec9d66d7136f3e276b0dd5e

    • SHA512

      9dea65a395a5aefcafa30fc141cb44ea4b8c6c286f10b71cccb375f9a0bce1e102653c26543e212d5331610a1c6043625d036e8fd50ffb2b38b30e753ed76d72

    • SSDEEP

      98304:5LXT3b5B8T4O1OiZ/iZHZsonSh1XbiRFqE0c+Jmpm:x52Tz1XZ/iZ5sFriRFt0c+Em

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks