General

  • Target

    0fa1095468937b63dd660b944e1473e4d285f08b82e18edd81f21ddf7c54cc25.exe

  • Size

    4.5MB

  • Sample

    241121-cfsd6axqby

  • MD5

    f8500ef014255ed6e41d00ea463fbd99

  • SHA1

    b796cbcaea95c0d0ca2b0810662296a847422837

  • SHA256

    0fa1095468937b63dd660b944e1473e4d285f08b82e18edd81f21ddf7c54cc25

  • SHA512

    0bea2f08c71446210e6028c38e42acf1a80e500089e2579ac0d7e7a24a5a98b0304d2528617bc7633290ede1a441f7460c6468f4aaa8820fd371bab54739e041

  • SSDEEP

    98304:0LGndMtSs1diDUEABksWQRChubqsLP+zhdBH8XMlMa+XMW4nC2:b8szfsoV32MoXMLC2

Malware Config

Extracted

Family

redline

Botnet

@wget2

C2

185.215.113.79:41465

Attributes
  • auth_value

    3e9eda97b6589ac15756de0ba010d48f

Targets

    • Target

      0fa1095468937b63dd660b944e1473e4d285f08b82e18edd81f21ddf7c54cc25.exe

    • Size

      4.5MB

    • MD5

      f8500ef014255ed6e41d00ea463fbd99

    • SHA1

      b796cbcaea95c0d0ca2b0810662296a847422837

    • SHA256

      0fa1095468937b63dd660b944e1473e4d285f08b82e18edd81f21ddf7c54cc25

    • SHA512

      0bea2f08c71446210e6028c38e42acf1a80e500089e2579ac0d7e7a24a5a98b0304d2528617bc7633290ede1a441f7460c6468f4aaa8820fd371bab54739e041

    • SSDEEP

      98304:0LGndMtSs1diDUEABksWQRChubqsLP+zhdBH8XMlMa+XMW4nC2:b8szfsoV32MoXMLC2

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks