General

  • Target

    189d4453d51c214fb933adad46d8bd13c1f5999099d6e774ba536efee4543084.exe

  • Size

    4.6MB

  • Sample

    241123-qfysts1ren

  • MD5

    f435c670b596d1b0357a5cbc3631f868

  • SHA1

    70d31dafdf36c1f62a1bffc7133be0d1abf2fb77

  • SHA256

    189d4453d51c214fb933adad46d8bd13c1f5999099d6e774ba536efee4543084

  • SHA512

    7ac0c8c4021bc93c4f3fd3b070e7b1ecee8ba9fb8956f9194dc433280aacdeee66e11ae436545bdc585367417dff7be5cc455466b59a340dd46e2e7ff78a7423

  • SSDEEP

    98304:hLcsH0pPcUEG4n+yCTvqDL8b8CEvrCYdZtpnn3tHaH:APcUEdn+yMiDYYCsrtpn3laH

Malware Config

Extracted

Family

redline

Botnet

@noilase

C2

92.119.113.189:21746

Attributes
  • auth_value

    de713911efa818890ac36085c9a0fc58

Targets

    • Target

      189d4453d51c214fb933adad46d8bd13c1f5999099d6e774ba536efee4543084.exe

    • Size

      4.6MB

    • MD5

      f435c670b596d1b0357a5cbc3631f868

    • SHA1

      70d31dafdf36c1f62a1bffc7133be0d1abf2fb77

    • SHA256

      189d4453d51c214fb933adad46d8bd13c1f5999099d6e774ba536efee4543084

    • SHA512

      7ac0c8c4021bc93c4f3fd3b070e7b1ecee8ba9fb8956f9194dc433280aacdeee66e11ae436545bdc585367417dff7be5cc455466b59a340dd46e2e7ff78a7423

    • SSDEEP

      98304:hLcsH0pPcUEG4n+yCTvqDL8b8CEvrCYdZtpnn3tHaH:APcUEdn+yMiDYYCsrtpn3laH

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks