General

  • Target

    2e12900865d2eec1931a062d93b667fa0627a3fb28702055fdda370f56165aa9.exe

  • Size

    4.6MB

  • Sample

    241124-asvnyavkdv

  • MD5

    f0a27521377e62ad7dd5626bfb0dae81

  • SHA1

    468695c96aa270fc97736919e218538b46410a06

  • SHA256

    2e12900865d2eec1931a062d93b667fa0627a3fb28702055fdda370f56165aa9

  • SHA512

    741515050e5db9c23cb1558e905139e13b182c75a57c7861293938fc6161024c303b10203ac747c7a19eca488f0a852cbd9eb1d9c46afb9b4061e7d129f91e7b

  • SSDEEP

    98304:ALAR9WAXsEVfPkhz4ZJZzWEEFQVHnvnW70ckb0EMgP32fDyWdEqD7ezeaibX:KAXsEVnkexKFQvWQrMgP32ryWWqD7eyd

Malware Config

Extracted

Family

redline

Botnet

716965980

C2

94.26.248.120:63731

Attributes
  • auth_value

    ee8187fd574be73a935e073f8b5705eb

Targets

    • Target

      2e12900865d2eec1931a062d93b667fa0627a3fb28702055fdda370f56165aa9.exe

    • Size

      4.6MB

    • MD5

      f0a27521377e62ad7dd5626bfb0dae81

    • SHA1

      468695c96aa270fc97736919e218538b46410a06

    • SHA256

      2e12900865d2eec1931a062d93b667fa0627a3fb28702055fdda370f56165aa9

    • SHA512

      741515050e5db9c23cb1558e905139e13b182c75a57c7861293938fc6161024c303b10203ac747c7a19eca488f0a852cbd9eb1d9c46afb9b4061e7d129f91e7b

    • SSDEEP

      98304:ALAR9WAXsEVfPkhz4ZJZzWEEFQVHnvnW70ckb0EMgP32fDyWdEqD7ezeaibX:KAXsEVnkexKFQvWQrMgP32ryWWqD7eyd

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks