General

  • Size

    1MB

  • Sample

    220321-hgrrxahfe7

  • MD5

    71f24a064cbf418f0eafa989cc08df8b

  • SHA1

    f1bd0876dc8ae7b61dc990d3df02c89e2a000015

  • SHA256

    cb2e12a627439114e3e5714e9746361739fb4c9f3dc8d9ee1207cea779dbc6ab

  • SHA512

    e7be544287848ad0ff57ce8692795a706976e4f357d64a364bdfe221ecd9c1e341875e1b9d679e2ed7df60cb5262918c1da7c4c45e875669a1f4f768394e293d

Malware Config

Extracted

Family

redline

Botnet

fullwork1488

C2

91.243.32.165:41754

Attributes
auth_value
a4384deb7b09a3c1c21c6447924c2d9a

Targets

    • Target

      352-215-0x0000000000FE0000-0x000000000111A000-memory.dmp

    • Size

      1MB

    • MD5

      71f24a064cbf418f0eafa989cc08df8b

    • SHA1

      f1bd0876dc8ae7b61dc990d3df02c89e2a000015

    • SHA256

      cb2e12a627439114e3e5714e9746361739fb4c9f3dc8d9ee1207cea779dbc6ab

    • SHA512

      e7be544287848ad0ff57ce8692795a706976e4f357d64a364bdfe221ecd9c1e341875e1b9d679e2ed7df60cb5262918c1da7c4c45e875669a1f4f768394e293d

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation