General

  • Target

    Setup.exe

  • Size

    1.3MB

  • Sample

    250127-aqawra1lfz

  • MD5

    714d58f5b01b719f6b7416d003fbabe7

  • SHA1

    a862c8863dfe7ad32790524dafb6412623cc9e5c

  • SHA256

    d2b9ad4e2bbee865a4011261a09aa8071bc887bc8e1b46f31aba1809fdcc49f3

  • SHA512

    09addec44fe156ec0e9d35b1141bd70d6d036a854eabbc69c6b7ec1e4b48e07b93575dec418d04d54f296515431907612ab472cd0796ab4894957073e4bbfad7

  • SSDEEP

    24576:HoxhSh73A6BYnrN+Zuu8aei+X9QtrPamU7iB0VLivBAVhkhV45ta5HULVcIrjdRv:IxwhfBYnB+ZSaelNkOny52awVcadR9ek

Malware Config

Extracted

Family

redline

C2

46.8.52.113:33214

Attributes
  • auth_value

    642669b902d96fda056f265803595e0b

Targets

    • Target

      Setup.exe

    • Size

      1.3MB

    • MD5

      714d58f5b01b719f6b7416d003fbabe7

    • SHA1

      a862c8863dfe7ad32790524dafb6412623cc9e5c

    • SHA256

      d2b9ad4e2bbee865a4011261a09aa8071bc887bc8e1b46f31aba1809fdcc49f3

    • SHA512

      09addec44fe156ec0e9d35b1141bd70d6d036a854eabbc69c6b7ec1e4b48e07b93575dec418d04d54f296515431907612ab472cd0796ab4894957073e4bbfad7

    • SSDEEP

      24576:HoxhSh73A6BYnrN+Zuu8aei+X9QtrPamU7iB0VLivBAVhkhV45ta5HULVcIrjdRv:IxwhfBYnB+ZSaelNkOny52awVcadR9ek

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks