General

  • Target

    77b789b242ac18fabd10da82f066c4942088b6f3e597038e3e3a8d33767aff77.exe

  • Size

    904KB

  • Sample

    241226-plfc1awjbr

  • MD5

    f0273be80e9c584e9c705c1d72f17187

  • SHA1

    087b4f1535daf7022feb6797bfffd679b63c5074

  • SHA256

    77b789b242ac18fabd10da82f066c4942088b6f3e597038e3e3a8d33767aff77

  • SHA512

    0ff01c822f0921585b39afdb1172e153eb85fdbaec80ff923275b57a13c3fe3affbf39cc6348a82cff345fdfb78d4fab69b01b19a3885f0485d44f5f25479d82

  • SSDEEP

    12288:L5JAhP+GQaRKCI19VcH03kiBkqiNRBrDdWZJb2xFKBLnssz4p5m7UC4gWjZnGLxI:L5J7ERKe0rBkzbqh3a

Malware Config

Extracted

Family

redline

Botnet

joana

C2

185.161.248.75:4132

Attributes
  • auth_value

    85090ed112d639bb782481da2912487a

Targets

    • Target

      77b789b242ac18fabd10da82f066c4942088b6f3e597038e3e3a8d33767aff77.exe

    • Size

      904KB

    • MD5

      f0273be80e9c584e9c705c1d72f17187

    • SHA1

      087b4f1535daf7022feb6797bfffd679b63c5074

    • SHA256

      77b789b242ac18fabd10da82f066c4942088b6f3e597038e3e3a8d33767aff77

    • SHA512

      0ff01c822f0921585b39afdb1172e153eb85fdbaec80ff923275b57a13c3fe3affbf39cc6348a82cff345fdfb78d4fab69b01b19a3885f0485d44f5f25479d82

    • SSDEEP

      12288:L5JAhP+GQaRKCI19VcH03kiBkqiNRBrDdWZJb2xFKBLnssz4p5m7UC4gWjZnGLxI:L5J7ERKe0rBkzbqh3a

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks