General

  • Target

    09c096c752bf13cedc116a6e94a10c296a1b8623bf803ee4549e2e89afe054a6.exe

  • Size

    385KB

  • Sample

    241122-2h9tna1lhx

  • MD5

    d97081073a9b9131935d910ca82e6556

  • SHA1

    9c7237b0f86f4b2c52fd991e1487fe7df200980f

  • SHA256

    09c096c752bf13cedc116a6e94a10c296a1b8623bf803ee4549e2e89afe054a6

  • SHA512

    05426033f8a864168b509bbe56c65a5a71e94bb27d98fd44cbf853599e38e3496aa2e7905e1eefa82f6464cc3cb7807c0b2ee11d0ef0c84c2e99c37296c0095c

  • SSDEEP

    12288:3/n1Y9EKnSu5yVzo6P/XLdszJcwRFW8B/iYvwdDEgiWcSgDN:369EO9

Malware Config

Extracted

Family

redline

Botnet

WUnlockAllToolIV2.61

C2

185.215.113.55:36801

Attributes
  • auth_value

    5c57f1eb36bb351b7007ba406bba7afc

Targets

    • Target

      09c096c752bf13cedc116a6e94a10c296a1b8623bf803ee4549e2e89afe054a6.exe

    • Size

      385KB

    • MD5

      d97081073a9b9131935d910ca82e6556

    • SHA1

      9c7237b0f86f4b2c52fd991e1487fe7df200980f

    • SHA256

      09c096c752bf13cedc116a6e94a10c296a1b8623bf803ee4549e2e89afe054a6

    • SHA512

      05426033f8a864168b509bbe56c65a5a71e94bb27d98fd44cbf853599e38e3496aa2e7905e1eefa82f6464cc3cb7807c0b2ee11d0ef0c84c2e99c37296c0095c

    • SSDEEP

      12288:3/n1Y9EKnSu5yVzo6P/XLdszJcwRFW8B/iYvwdDEgiWcSgDN:369EO9

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks