General

  • Target

    d2fbaeb73d58094885624336bf42854d2dae0d05b4adb55e74254770edff65e6N.exe

  • Size

    349KB

  • Sample

    250208-g19w6a1pgl

  • MD5

    7595297d38d9efe20dfe298a9823dec0

  • SHA1

    ad1cf7dab62253736b3003c5059b538e0b699ba8

  • SHA256

    d2fbaeb73d58094885624336bf42854d2dae0d05b4adb55e74254770edff65e6

  • SHA512

    9810b11791aa7bd14844cf0ba65be9600168e5fa98bd1f88e9590452c4d0a3a68af1e3cffa681ec7795cdda126dd6761283b3941edd928313ac296681ebf5c3b

  • SSDEEP

    6144:lf8U45sAEVvvRKPD79St21x3HA/kGYniBc0zuc7:qF5bERZKPD79DxQOiBc0V7

Malware Config

Extracted

Family

redline

Botnet

metro

C2

83.97.73.127:19045

Attributes
  • auth_value

    f7fd4aa816bdbaad933b45b51d9b6b1a

Targets

    • Target

      d2fbaeb73d58094885624336bf42854d2dae0d05b4adb55e74254770edff65e6N.exe

    • Size

      349KB

    • MD5

      7595297d38d9efe20dfe298a9823dec0

    • SHA1

      ad1cf7dab62253736b3003c5059b538e0b699ba8

    • SHA256

      d2fbaeb73d58094885624336bf42854d2dae0d05b4adb55e74254770edff65e6

    • SHA512

      9810b11791aa7bd14844cf0ba65be9600168e5fa98bd1f88e9590452c4d0a3a68af1e3cffa681ec7795cdda126dd6761283b3941edd928313ac296681ebf5c3b

    • SSDEEP

      6144:lf8U45sAEVvvRKPD79St21x3HA/kGYniBc0zuc7:qF5bERZKPD79DxQOiBc0V7

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Downloads MZ/PE file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks