General

  • Target

    f755fcaa03d47b3a0066b086b32a5f4acfb6fbe7205c3f084500d2bed603dee2.exe

  • Size

    386KB

  • Sample

    241122-mqfs8ayphv

  • MD5

    5dd353806b2a7c0488ad283521d3a617

  • SHA1

    46139cee8aa5649d4ba2ac6f7fe1e8d515462b58

  • SHA256

    f755fcaa03d47b3a0066b086b32a5f4acfb6fbe7205c3f084500d2bed603dee2

  • SHA512

    1ebd178c5c86d2faa88d96db2da20c093112bbff1479b3cf55c6a0c9a95cf55c87cbcf3316f02f013ddfa6d9319b210a654c04164ce336f43662a906b0196a00

  • SSDEEP

    12288:G/I169Esn3uaHsxoMsA/XCgcIs4MEOGJ/iI9LJdDEYE2:G19E9Dz

Malware Config

Extracted

Family

redline

Botnet

james222

C2

135.181.129.119:4805

Attributes
  • auth_value

    b69102cdbd4afe2d3159f88fb6dac731

Targets

    • Target

      f755fcaa03d47b3a0066b086b32a5f4acfb6fbe7205c3f084500d2bed603dee2.exe

    • Size

      386KB

    • MD5

      5dd353806b2a7c0488ad283521d3a617

    • SHA1

      46139cee8aa5649d4ba2ac6f7fe1e8d515462b58

    • SHA256

      f755fcaa03d47b3a0066b086b32a5f4acfb6fbe7205c3f084500d2bed603dee2

    • SHA512

      1ebd178c5c86d2faa88d96db2da20c093112bbff1479b3cf55c6a0c9a95cf55c87cbcf3316f02f013ddfa6d9319b210a654c04164ce336f43662a906b0196a00

    • SSDEEP

      12288:G/I169Esn3uaHsxoMsA/XCgcIs4MEOGJ/iI9LJdDEYE2:G19E9Dz

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks