General

  • Target

    6cc44d98ce2fb628b25519eb2aa476b81c1dca23b4c11fb3f26951bba8e68d64.zip

  • Size

    653KB

  • Sample

    241206-p68v2strak

  • MD5

    d02467ffd5b13bfef3cc0e8db07413c2

  • SHA1

    c3c83189de3bed9d9d48401e82f84b7165bee220

  • SHA256

    0937a738282fbc6ec10c9bdf9f94d76cfb4832fcfff549da33ff15df16de2cd9

  • SHA512

    39d3b4abaa866abb8255ac16d89983c000474df5467e70c49e9fec1efa38d726c9a61ab33ec3ffb06ee184aee24328dd057f7fcd1aad754dc11b8b3004722c4f

  • SSDEEP

    12288:m/nbUDyMIiTTQQLqtyaqg1rKJkMFYDyT1q+JUKb/yCi4YwXqELezL2v:mixkKTRmIb2LDjwdeHy

Malware Config

Extracted

Family

redline

Botnet

@jeamoff

C2

5.182.36.101:31305

Attributes
  • auth_value

    7c2fde5fc33439094a0b76dd7b33f7cd

Targets

    • Target

      6cc44d98ce2fb628b25519eb2aa476b81c1dca23b4c11fb3f26951bba8e68d64.exe

    • Size

      2.4MB

    • MD5

      b3998f79a78baef7cf93c7e26b07d16b

    • SHA1

      45127505d72584c690418d81c7f2b24cb7ffe84d

    • SHA256

      6cc44d98ce2fb628b25519eb2aa476b81c1dca23b4c11fb3f26951bba8e68d64

    • SHA512

      9927feba765d7f17f16e5daccac7065801e241c4c6a1f1045e784e72d5ef5c71ca57d67ee6e24009b0af67b44d98248d0019d9b2f63332b4e77697b158afc282

    • SSDEEP

      24576:eBP8ORYWYNzBqY/M9mo6ernms16sloTzR5SXggBMVmnL9RLr3Pl3RuQ55313V:eR8jMfloTF5SJMVmnL9Rnl3P

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks