General

  • Target

    0b2820a5f6d460c09afa1fce2667d4e89d8996af73c6be0967983e9f4b57b357N.exe

  • Size

    904KB

  • Sample

    241226-txmzfazqfx

  • MD5

    4a0f06f0e089849f0e93563bdd1dd520

  • SHA1

    0e57a4a1ee51d876b2ee039222c58bc6cb9a976e

  • SHA256

    0b2820a5f6d460c09afa1fce2667d4e89d8996af73c6be0967983e9f4b57b357

  • SHA512

    38c8a72aab47188a64a2d4bad91372766a48758ba2b45ac8a238c6390e66861b2c8b41de3d11452c233f5850defb7df0882bc944530302b579c03059f74fbe47

  • SSDEEP

    12288:L5JAhP+GQaRKCI19VcH03kiBkqiNRBrDdWZJb2xFKBLnssz4p5m7UC4gWjZnGLxR:L5J7ERKe0rBkzbqh3

Malware Config

Extracted

Family

redline

Botnet

joana

C2

185.161.248.75:4132

Attributes
  • auth_value

    85090ed112d639bb782481da2912487a

Targets

    • Target

      0b2820a5f6d460c09afa1fce2667d4e89d8996af73c6be0967983e9f4b57b357N.exe

    • Size

      904KB

    • MD5

      4a0f06f0e089849f0e93563bdd1dd520

    • SHA1

      0e57a4a1ee51d876b2ee039222c58bc6cb9a976e

    • SHA256

      0b2820a5f6d460c09afa1fce2667d4e89d8996af73c6be0967983e9f4b57b357

    • SHA512

      38c8a72aab47188a64a2d4bad91372766a48758ba2b45ac8a238c6390e66861b2c8b41de3d11452c233f5850defb7df0882bc944530302b579c03059f74fbe47

    • SSDEEP

      12288:L5JAhP+GQaRKCI19VcH03kiBkqiNRBrDdWZJb2xFKBLnssz4p5m7UC4gWjZnGLxR:L5J7ERKe0rBkzbqh3

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks