General

  • Target

    164d2764ac3a0e4178010cb9a9c69c2b861bfce9cfd87e7274019f64fc1b6330.exe

  • Size

    518KB

  • Sample

    241123-n8nr8a1jgr

  • MD5

    a6a96a612c309d839821f6e7128a119e

  • SHA1

    f1a15cf0b6c0022480d37606bfcfef270ca39ba0

  • SHA256

    164d2764ac3a0e4178010cb9a9c69c2b861bfce9cfd87e7274019f64fc1b6330

  • SHA512

    a43ef25c0546f4e6ad000b343a5f3ff074865ead05a76b1039ccbf8455eb82d81425e6cffa85bcbc8254950899554ff6f18601f511226fee116234d17042eb25

  • SSDEEP

    3072:22QO7oDuy0aJ5+ISDOnXDsHHZt0N8dAJ2yAGflgsQVpLf:22cuG5+IJAz0N82J2xAbQVpr

Malware Config

Extracted

Family

redline

C2

141.94.188.138:46419

Attributes
  • auth_value

    3f48b95855158031ae9e7dafcb203009

Targets

    • Target

      164d2764ac3a0e4178010cb9a9c69c2b861bfce9cfd87e7274019f64fc1b6330.exe

    • Size

      518KB

    • MD5

      a6a96a612c309d839821f6e7128a119e

    • SHA1

      f1a15cf0b6c0022480d37606bfcfef270ca39ba0

    • SHA256

      164d2764ac3a0e4178010cb9a9c69c2b861bfce9cfd87e7274019f64fc1b6330

    • SHA512

      a43ef25c0546f4e6ad000b343a5f3ff074865ead05a76b1039ccbf8455eb82d81425e6cffa85bcbc8254950899554ff6f18601f511226fee116234d17042eb25

    • SSDEEP

      3072:22QO7oDuy0aJ5+ISDOnXDsHHZt0N8dAJ2yAGflgsQVpLf:22cuG5+IJAz0N82J2xAbQVpr

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks