General

  • Target

    b8f61039ce5eaa5f918c00ca9728b023cf4949d8d218e5d7537321f7a043a79d

  • Size

    308KB

  • Sample

    250206-esdgwaskgz

  • MD5

    63174486cdb043cf0b8dd03fc5861f53

  • SHA1

    80345ef2180d589ef844c3b49ebd67294ac843ff

  • SHA256

    b8f61039ce5eaa5f918c00ca9728b023cf4949d8d218e5d7537321f7a043a79d

  • SHA512

    f674c7e36ebc2a0a192fe34a0b647365ff9f545792498dbf5d37db8834fa3af445503900697a3cf3cefdb2fbeccac42bfd0c5506c9eb1009800be270d5aa631a

  • SSDEEP

    6144:QJieURFHjpMnTDs7UNVS49kCNQSzrs5kLJhHVugiqtciLRc1tgP:QJIRED7NQSzrs5kLJhHVugiqtciLRygP

Malware Config

Extracted

Family

redline

Botnet

crazy

C2

83.97.73.129:19068

Attributes
  • auth_value

    66bc4d9682ea090eef64a299ece12fdd

Targets

    • Target

      b8f61039ce5eaa5f918c00ca9728b023cf4949d8d218e5d7537321f7a043a79d

    • Size

      308KB

    • MD5

      63174486cdb043cf0b8dd03fc5861f53

    • SHA1

      80345ef2180d589ef844c3b49ebd67294ac843ff

    • SHA256

      b8f61039ce5eaa5f918c00ca9728b023cf4949d8d218e5d7537321f7a043a79d

    • SHA512

      f674c7e36ebc2a0a192fe34a0b647365ff9f545792498dbf5d37db8834fa3af445503900697a3cf3cefdb2fbeccac42bfd0c5506c9eb1009800be270d5aa631a

    • SSDEEP

      6144:QJieURFHjpMnTDs7UNVS49kCNQSzrs5kLJhHVugiqtciLRc1tgP:QJIRED7NQSzrs5kLJhHVugiqtciLRygP

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks