General

  • Target

    1ccca772e7b7f2e3ed75be4f8468c16e9c6908038f79a01bb8676545f930022e.exe

  • Size

    170KB

  • Sample

    241123-zfvkvavpf1

  • MD5

    c0855a9ff9caaee34698f94b018023d3

  • SHA1

    c21f616f99bdf96eca0d849f179d3c8832fd7207

  • SHA256

    1ccca772e7b7f2e3ed75be4f8468c16e9c6908038f79a01bb8676545f930022e

  • SHA512

    e1e70f1c36899ee11105538bfbd356cfcae6fa97e9211611a8e09afdfc32e67f90bb09acec0a67a7c8fc021e8663ec2b95c3224a6579f73665b8e06081bd12b8

  • SSDEEP

    3072:MPk/Hi905McLeFHNrmOWnxY+USfLo6wzO3gJ:NHi90MEwkYdVfzO3A

Malware Config

Extracted

Family

redline

C2

141.94.188.138:46419

Attributes
  • auth_value

    3f48b95855158031ae9e7dafcb203009

Targets

    • Target

      1ccca772e7b7f2e3ed75be4f8468c16e9c6908038f79a01bb8676545f930022e.exe

    • Size

      170KB

    • MD5

      c0855a9ff9caaee34698f94b018023d3

    • SHA1

      c21f616f99bdf96eca0d849f179d3c8832fd7207

    • SHA256

      1ccca772e7b7f2e3ed75be4f8468c16e9c6908038f79a01bb8676545f930022e

    • SHA512

      e1e70f1c36899ee11105538bfbd356cfcae6fa97e9211611a8e09afdfc32e67f90bb09acec0a67a7c8fc021e8663ec2b95c3224a6579f73665b8e06081bd12b8

    • SSDEEP

      3072:MPk/Hi905McLeFHNrmOWnxY+USfLo6wzO3gJ:NHi90MEwkYdVfzO3A

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks