General

  • Target

    c89abdd69e6efb979ee9f2da15010b3140c2676dc0ecf34e8b98a4dc0faa8cfd.exe

  • Size

    4.6MB

  • Sample

    241122-qsekqa1pe1

  • MD5

    2084aae629a03bf013755ee4d87b9d8c

  • SHA1

    30ad18806d3999c08d8d30c38d9a67927da3e847

  • SHA256

    c89abdd69e6efb979ee9f2da15010b3140c2676dc0ecf34e8b98a4dc0faa8cfd

  • SHA512

    9717ee342fc35f3d4291e7223cf44503cb6a970a986737d618cbfcfb006fcaaedaf78352b1d220fd6a3b439f1962c92947a06bed5b427de20c77da28e6594c5d

  • SSDEEP

    98304:zLwiAM0fvDFoF3QsvwOQoWq1bksQD9Av9sAwky+So5sY3wdmyHV:b0Mg/ObW+bksQBW92ky+S0sY3emI

Malware Config

Extracted

Family

redline

Botnet

@Temshik159

C2

185.209.22.181:29234

Attributes
  • auth_value

    5a0918bd3e8ede8e02c8dd9d106a996d

Targets

    • Target

      c89abdd69e6efb979ee9f2da15010b3140c2676dc0ecf34e8b98a4dc0faa8cfd.exe

    • Size

      4.6MB

    • MD5

      2084aae629a03bf013755ee4d87b9d8c

    • SHA1

      30ad18806d3999c08d8d30c38d9a67927da3e847

    • SHA256

      c89abdd69e6efb979ee9f2da15010b3140c2676dc0ecf34e8b98a4dc0faa8cfd

    • SHA512

      9717ee342fc35f3d4291e7223cf44503cb6a970a986737d618cbfcfb006fcaaedaf78352b1d220fd6a3b439f1962c92947a06bed5b427de20c77da28e6594c5d

    • SSDEEP

      98304:zLwiAM0fvDFoF3QsvwOQoWq1bksQD9Av9sAwky+So5sY3wdmyHV:b0Mg/ObW+bksQBW92ky+S0sY3emI

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks