General

  • Target

    309621355c48f1d8b77d4df0cfb99a32dbd0ab78f234b6c12934d9f3a1503af8.exe

  • Size

    857KB

  • Sample

    250110-rwaxdayqgp

  • MD5

    12dea314db7aa2b97f2c43a4081d4f66

  • SHA1

    67c73c5207f877ca7a075f38ff32acb4129ecf17

  • SHA256

    309621355c48f1d8b77d4df0cfb99a32dbd0ab78f234b6c12934d9f3a1503af8

  • SHA512

    9c9dd9b9011739ce1159e302690dc522110d5fe33b671074aa1193b9cc7576abc9d4017ff49adf2c473d8e52582395f0b3a9f2db65e026e0e021c8067facabdc

  • SSDEEP

    24576:3fIeejFpYqPMy5lp8/EZWmBCfpAJ7WXYsstJ:PBejFp/0iwReChA1WXCf

Malware Config

Extracted

Family

redline

Botnet

LOGS

C2

87.120.120.86:1912

Targets

    • Target

      309621355c48f1d8b77d4df0cfb99a32dbd0ab78f234b6c12934d9f3a1503af8.exe

    • Size

      857KB

    • MD5

      12dea314db7aa2b97f2c43a4081d4f66

    • SHA1

      67c73c5207f877ca7a075f38ff32acb4129ecf17

    • SHA256

      309621355c48f1d8b77d4df0cfb99a32dbd0ab78f234b6c12934d9f3a1503af8

    • SHA512

      9c9dd9b9011739ce1159e302690dc522110d5fe33b671074aa1193b9cc7576abc9d4017ff49adf2c473d8e52582395f0b3a9f2db65e026e0e021c8067facabdc

    • SSDEEP

      24576:3fIeejFpYqPMy5lp8/EZWmBCfpAJ7WXYsstJ:PBejFp/0iwReChA1WXCf

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks