General

  • Target

    6f1712eae5496394e6b4e0401ab24d399b7e34dc21d8d3341e7398238c4de5b4N.exe

  • Size

    261KB

  • Sample

    250208-dk4tes1qb1

  • MD5

    7c8af162128d0bdaf8ad55c506bf7110

  • SHA1

    6728e5a5f66685afdebac5020a7d45dd91383a29

  • SHA256

    6f1712eae5496394e6b4e0401ab24d399b7e34dc21d8d3341e7398238c4de5b4

  • SHA512

    c3281994e521ed1d313678bdfba9912c4b22ceea865178514af3dda7a51f90e668a80fd75bdafa648834913c5a91307154271d13f219f16595f73d8c3134d790

  • SSDEEP

    3072:WJhg7bWY1OhGO1RyHFaQ7RQ05CTEezbClXv8r8+oFe6gobFHFzA+E+2yQHcj/:WvgOY1QqFaQ7W05AEezbMPZFzAy2yA

Malware Config

Extracted

Family

redline

Botnet

sheron

C2

83.97.73.129:19068

Attributes
  • auth_value

    2d067e7e2372227d3a03b335260112e9

Targets

    • Target

      6f1712eae5496394e6b4e0401ab24d399b7e34dc21d8d3341e7398238c4de5b4N.exe

    • Size

      261KB

    • MD5

      7c8af162128d0bdaf8ad55c506bf7110

    • SHA1

      6728e5a5f66685afdebac5020a7d45dd91383a29

    • SHA256

      6f1712eae5496394e6b4e0401ab24d399b7e34dc21d8d3341e7398238c4de5b4

    • SHA512

      c3281994e521ed1d313678bdfba9912c4b22ceea865178514af3dda7a51f90e668a80fd75bdafa648834913c5a91307154271d13f219f16595f73d8c3134d790

    • SSDEEP

      3072:WJhg7bWY1OhGO1RyHFaQ7RQ05CTEezbClXv8r8+oFe6gobFHFzA+E+2yQHcj/:WvgOY1QqFaQ7W05AEezbMPZFzAy2yA

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Downloads MZ/PE file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks