General

  • Target

    750abf4e27c2a49525a2ea46954c118a0fa43f1db6fa3e3288b05d08a433e17e.exe

  • Size

    382KB

  • Sample

    241122-kqr55stmfm

  • MD5

    cba4902dfb85b45b0c1b318af722d7b4

  • SHA1

    ae8b9a546939e5eb25007eea8f51dbff279a5525

  • SHA256

    750abf4e27c2a49525a2ea46954c118a0fa43f1db6fa3e3288b05d08a433e17e

  • SHA512

    76fc1b59eae98ee6559d674ac1e396253a1f7984244afce4810132ce3e1777584e117680e2044b3ca87e8a482e3ca5474970e0a1d97723b4a1b1f6051a908ecf

  • SSDEEP

    6144:Zwhm1Xp5+04PXa3mWOq/Yk63o/Bm5gVCFW:iQ1Xp5X4PXa3mWOq/p63o/Bm54CFW

Malware Config

Extracted

Family

redline

Botnet

YTube

C2

195.2.93.155:17354

Attributes
  • auth_value

    4417d112a2503e368d8855f260c962d3

Targets

    • Target

      750abf4e27c2a49525a2ea46954c118a0fa43f1db6fa3e3288b05d08a433e17e.exe

    • Size

      382KB

    • MD5

      cba4902dfb85b45b0c1b318af722d7b4

    • SHA1

      ae8b9a546939e5eb25007eea8f51dbff279a5525

    • SHA256

      750abf4e27c2a49525a2ea46954c118a0fa43f1db6fa3e3288b05d08a433e17e

    • SHA512

      76fc1b59eae98ee6559d674ac1e396253a1f7984244afce4810132ce3e1777584e117680e2044b3ca87e8a482e3ca5474970e0a1d97723b4a1b1f6051a908ecf

    • SSDEEP

      6144:Zwhm1Xp5+04PXa3mWOq/Yk63o/Bm5gVCFW:iQ1Xp5X4PXa3mWOq/p63o/Bm54CFW

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks