General

  • Target

    845591961f7c70996b75310a0817420e9c79ffa9861e67f790078fd1903bf82b.exe

  • Size

    323KB

  • Sample

    250208-f7l81axray

  • MD5

    0ca8773ba98405057fd480985d7df748

  • SHA1

    91980f68d6192361dbcbab2769730f3e316825cb

  • SHA256

    845591961f7c70996b75310a0817420e9c79ffa9861e67f790078fd1903bf82b

  • SHA512

    a6a7630b877c99b90bca2a3eeebb38be9c1182901dc49b9e442b0d44c2ae212d9ceef088bc603532d254f7ccca3a46ce5940912aa50503acdaa4715a5f218eef

  • SSDEEP

    6144:8qvtOTpNbivUTJ403lDLFCkBlN0jVlM6tIzDW+9lEnQ2m3iIk:tOTpNQUTJ403lH8kB8jnM6tIW+/EnQ2L

Malware Config

Extracted

Family

redline

Botnet

greg

C2

83.97.73.122:19062

Attributes
  • auth_value

    4c966a90781c6b4ab7f512d018696362

Targets

    • Target

      845591961f7c70996b75310a0817420e9c79ffa9861e67f790078fd1903bf82b.exe

    • Size

      323KB

    • MD5

      0ca8773ba98405057fd480985d7df748

    • SHA1

      91980f68d6192361dbcbab2769730f3e316825cb

    • SHA256

      845591961f7c70996b75310a0817420e9c79ffa9861e67f790078fd1903bf82b

    • SHA512

      a6a7630b877c99b90bca2a3eeebb38be9c1182901dc49b9e442b0d44c2ae212d9ceef088bc603532d254f7ccca3a46ce5940912aa50503acdaa4715a5f218eef

    • SSDEEP

      6144:8qvtOTpNbivUTJ403lDLFCkBlN0jVlM6tIzDW+9lEnQ2m3iIk:tOTpNQUTJ403lH8kB8jnM6tIW+/EnQ2L

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Downloads MZ/PE file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks