General

  • Target

    b1ec4a0819d382e1b72ec4a3db6053e8113b0b001cb018f88e365f3ecf2afd7a.exe

  • Size

    349KB

  • Sample

    250208-hkjwgaspal

  • MD5

    fc318762b9438646d1b9a46f85f4d396

  • SHA1

    27565fe6ddd4896b22b3be452ab0908a310be8cd

  • SHA256

    b1ec4a0819d382e1b72ec4a3db6053e8113b0b001cb018f88e365f3ecf2afd7a

  • SHA512

    b82f3a58012e2c838eeeaed4ceeeaf74b96f0c15b287aee1faf71b16ee49042ffda261620f28b3fb323fdc459802cd56651b5d4aa46d7ab1f0b4e5f16881892e

  • SSDEEP

    6144:lf8U45sAEVvvRKPD79St21x3HA/kGYniBc0zucD:qF5bERZKPD79DxQOiBc0VD

Malware Config

Extracted

Family

redline

Botnet

metro

C2

83.97.73.127:19045

Attributes
  • auth_value

    f7fd4aa816bdbaad933b45b51d9b6b1a

Targets

    • Target

      b1ec4a0819d382e1b72ec4a3db6053e8113b0b001cb018f88e365f3ecf2afd7a.exe

    • Size

      349KB

    • MD5

      fc318762b9438646d1b9a46f85f4d396

    • SHA1

      27565fe6ddd4896b22b3be452ab0908a310be8cd

    • SHA256

      b1ec4a0819d382e1b72ec4a3db6053e8113b0b001cb018f88e365f3ecf2afd7a

    • SHA512

      b82f3a58012e2c838eeeaed4ceeeaf74b96f0c15b287aee1faf71b16ee49042ffda261620f28b3fb323fdc459802cd56651b5d4aa46d7ab1f0b4e5f16881892e

    • SSDEEP

      6144:lf8U45sAEVvvRKPD79St21x3HA/kGYniBc0zucD:qF5bERZKPD79DxQOiBc0VD

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks