General

  • Target

    d6ceb78f6e8263216c727660761a85b2bf8c37c9b6eec5a564c251ec81585d1b

  • Size

    2.7MB

  • Sample

    241122-feenfsvkgx

  • MD5

    e9d45eb873b8c5101a61f7027d923cfc

  • SHA1

    841e570b2e9054fe0c3be8369c3ca12e00b6b46f

  • SHA256

    d6ceb78f6e8263216c727660761a85b2bf8c37c9b6eec5a564c251ec81585d1b

  • SHA512

    8cbac6688e6d290f6a412fce4feaf8fd3088ab7ece1b89454e454c4e60300ae6f930fe0157e0dba18db16e315465898232e3c37e3073ce55eb934ab569e183db

  • SSDEEP

    6144:ROYzcbHES+VvHfl/c4Df810g3W/yZEXAWFsCbpCFOh:ROYs+lHfl/cIq3+IENZb

Malware Config

Extracted

Family

redline

Botnet

INSTALLAB2

C2

65.109.128.140:27702

Attributes
  • auth_value

    5e938a230b2dc75cf1ddef19b610ef84

Targets

    • Target

      d6ceb78f6e8263216c727660761a85b2bf8c37c9b6eec5a564c251ec81585d1b

    • Size

      2.7MB

    • MD5

      e9d45eb873b8c5101a61f7027d923cfc

    • SHA1

      841e570b2e9054fe0c3be8369c3ca12e00b6b46f

    • SHA256

      d6ceb78f6e8263216c727660761a85b2bf8c37c9b6eec5a564c251ec81585d1b

    • SHA512

      8cbac6688e6d290f6a412fce4feaf8fd3088ab7ece1b89454e454c4e60300ae6f930fe0157e0dba18db16e315465898232e3c37e3073ce55eb934ab569e183db

    • SSDEEP

      6144:ROYzcbHES+VvHfl/c4Df810g3W/yZEXAWFsCbpCFOh:ROYs+lHfl/cIq3+IENZb

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks