General

  • Target

    56b0721c8f301a83bd60b7c072bb8d3e66b24f75dec4f7329bfbd61346b9c7e5.exe

  • Size

    4.6MB

  • Sample

    241123-nsj44azrbk

  • MD5

    6ce76a7c4f1744df759054f490008259

  • SHA1

    372ac9d1e9111d0e561617801230b9d8cba47053

  • SHA256

    56b0721c8f301a83bd60b7c072bb8d3e66b24f75dec4f7329bfbd61346b9c7e5

  • SHA512

    8f012ac46942452537cc6ad3b6453859a92154e3631492012f8d4ef050a052519ba7050b391d40f2a2ba1f86ed622be25942da87734b52e02f2541c5db1bea22

  • SSDEEP

    98304:TLItktL6iCCeM8kgD8qzjlxQjNbsJz+ZbpV+3n28E0zgS:rCCu9jzj3QjZdZbp83n28E0j

Malware Config

Extracted

Family

redline

Botnet

@kakyoinnoriakki

C2

138.124.186.121:45760

Attributes
  • auth_value

    9b509f3ca2ec2a739920d789362e5ac4

Targets

    • Target

      56b0721c8f301a83bd60b7c072bb8d3e66b24f75dec4f7329bfbd61346b9c7e5.exe

    • Size

      4.6MB

    • MD5

      6ce76a7c4f1744df759054f490008259

    • SHA1

      372ac9d1e9111d0e561617801230b9d8cba47053

    • SHA256

      56b0721c8f301a83bd60b7c072bb8d3e66b24f75dec4f7329bfbd61346b9c7e5

    • SHA512

      8f012ac46942452537cc6ad3b6453859a92154e3631492012f8d4ef050a052519ba7050b391d40f2a2ba1f86ed622be25942da87734b52e02f2541c5db1bea22

    • SSDEEP

      98304:TLItktL6iCCeM8kgD8qzjlxQjNbsJz+ZbpV+3n28E0zgS:rCCu9jzj3QjZdZbp83n28E0j

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks