General

  • Target

    688851b3d020213958e978a00a32113326d2ee66a6bfc5cceb279e393da2ea86

  • Size

    3.8MB

  • Sample

    241221-tne78sspdk

  • MD5

    61cdf7e4eca424c763178c94c7ef760f

  • SHA1

    f2096fd54988dbf5a8a9dab58bbd2f919661c5ab

  • SHA256

    688851b3d020213958e978a00a32113326d2ee66a6bfc5cceb279e393da2ea86

  • SHA512

    6eb87a0bc294d6e4920fc82e9ae2ec397f2a3e31fde8a03644f21216e91aa27148b99e5ae8c92ef9a930ec20c9306a97b33e316fb8b8b981cde9a5df10920812

  • SSDEEP

    98304:nyBQbqAIBax9N1kCvwYxgAmZtd6xcN2QBYMYhRkbp97:nyIioXwYOAgd6KX9Y/y3

Malware Config

Extracted

Family

redline

C2

91.243.32.73:7171

Attributes
  • auth_value

    f0eaa7ad30bc41521e3d61c8504e5715

Targets

    • Target

      688851b3d020213958e978a00a32113326d2ee66a6bfc5cceb279e393da2ea86

    • Size

      3.8MB

    • MD5

      61cdf7e4eca424c763178c94c7ef760f

    • SHA1

      f2096fd54988dbf5a8a9dab58bbd2f919661c5ab

    • SHA256

      688851b3d020213958e978a00a32113326d2ee66a6bfc5cceb279e393da2ea86

    • SHA512

      6eb87a0bc294d6e4920fc82e9ae2ec397f2a3e31fde8a03644f21216e91aa27148b99e5ae8c92ef9a930ec20c9306a97b33e316fb8b8b981cde9a5df10920812

    • SSDEEP

      98304:nyBQbqAIBax9N1kCvwYxgAmZtd6xcN2QBYMYhRkbp97:nyIioXwYOAgd6KX9Y/y3

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    • Target

      $TEMP/F1gaSebe_crypted.exe

    • Size

      807KB

    • MD5

      5f6b473388665e4c29cf86b97acd05f0

    • SHA1

      6cc67923b21ef5df391b211243e9bca3f47851dc

    • SHA256

      616ceb62d1c53a9837635e51abd73b8c717a9d20b1cc882d1420a46c385d8304

    • SHA512

      de3253a8714558da0621dbfcf72e4bceeed563785158f2830061f54d6b14b6a1eeb5d7abf349b9566ebcbb38afc4a0f8757ef94eae58e4eea578a98b4633fd66

    • SSDEEP

      12288:ymvQ2piRFz9kBAMKsikenkh52IdhvVjF:y+Smbj

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

    • Target

      $TEMP/Shortfalls.exe

    • Size

      3.6MB

    • MD5

      1b8ae5c577608b9f780b3ad704679e0a

    • SHA1

      4402007d8e5ca59fe704d543a417c77e39dce762

    • SHA256

      039a6fd68c38bd081e9bca0181187df2653e501b5795d24ad6f895cf81c50bdf

    • SHA512

      9cc97013331ef3d4fbce1d1656ee5a28c193a50eabbf8fd75f2f1a8c57c00d2b32f82bdb35896209e3d7e24babfed607656b6e4a11a910fa099fbc25340587b3

    • SSDEEP

      98304:Gm+wj+XNf1GKVwspuM2ntX8RIx44l6MeNDkVly:262xwssMcX8q/bex2

    Score
    4/10

MITRE ATT&CK Enterprise v15

Tasks