General

  • Target

    https://download1590.mediafire.com/wwan818ym6ngV2UAcgiUqbZ7f45gbV-8JRb8KKHPpn1zgswvE7BJ2EF8Alxk4vvL0XqQyfyN5siKl3QZkS3p0A4nTC1EWjYMVC_k8DjeNHWKQLj_Tt8CcY82w4Qa2CNzVCbZKxk0nGBe5Cr1nGJlnv4-NFYXxfxD5iK0sKNa_uM_rQ/p0km9ne321dgyw8/launch%D0%B5r-p%D1%81.zip

  • Sample

    241127-zankcavqdp

Malware Config

Extracted

Family

redline

Botnet

@miromistin0

C2

94.142.138.4:80

Attributes
  • auth_value

    2ee380277e944675703ad248459af8c3

Targets

    • Target

      https://download1590.mediafire.com/wwan818ym6ngV2UAcgiUqbZ7f45gbV-8JRb8KKHPpn1zgswvE7BJ2EF8Alxk4vvL0XqQyfyN5siKl3QZkS3p0A4nTC1EWjYMVC_k8DjeNHWKQLj_Tt8CcY82w4Qa2CNzVCbZKxk0nGBe5Cr1nGJlnv4-NFYXxfxD5iK0sKNa_uM_rQ/p0km9ne321dgyw8/launch%D0%B5r-p%D1%81.zip

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks