General

  • Target

    d4f13bfbf726b883d94ff29a75382e7abf8e751373572c4ba427e45407d9d75cN.exe

  • Size

    4.2MB

  • Sample

    241125-dpmqpsvqg1

  • MD5

    73326ee382121f5a8bdbcc37e3c8b940

  • SHA1

    08cd8757c1f2c0c3354ecc0807ab9aca793515a9

  • SHA256

    d4f13bfbf726b883d94ff29a75382e7abf8e751373572c4ba427e45407d9d75c

  • SHA512

    59738756be3776af55712af32717aab80c571844bc6676e23a656eaf88ea142a066316168c95ac4fb7050b9c936d3183d6f6ef857271dee527bc26d661db5699

  • SSDEEP

    98304:UFVySWe/aWDDOkHPtwsLw1Dl7JGY3K8ujThIOMsEXvsx6bCFFAn:ULySWePDDOkvXLw7cWejThIOMjXv9OK

Malware Config

Extracted

Family

redline

Botnet

@sc4lly1337

C2

185.215.113.83:60722

Attributes
  • auth_value

    cb96f2ad461ba2dc951cb5a868225e22

Targets

    • Target

      d4f13bfbf726b883d94ff29a75382e7abf8e751373572c4ba427e45407d9d75cN.exe

    • Size

      4.2MB

    • MD5

      73326ee382121f5a8bdbcc37e3c8b940

    • SHA1

      08cd8757c1f2c0c3354ecc0807ab9aca793515a9

    • SHA256

      d4f13bfbf726b883d94ff29a75382e7abf8e751373572c4ba427e45407d9d75c

    • SHA512

      59738756be3776af55712af32717aab80c571844bc6676e23a656eaf88ea142a066316168c95ac4fb7050b9c936d3183d6f6ef857271dee527bc26d661db5699

    • SSDEEP

      98304:UFVySWe/aWDDOkHPtwsLw1Dl7JGY3K8ujThIOMsEXvsx6bCFFAn:ULySWePDDOkvXLw7cWejThIOMjXv9OK

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks