General

  • Target

    1448-64-0x0000000000280000-0x00000000002A0000-memory.dmp

  • Size

    128KB

  • Sample

    220510-sl5jnshgb3

  • MD5

    45776fba0e7012c618d37a47b8cc259d

  • SHA1

    a5101b2a422a8e66d6ea673e803d9035add3a5ed

  • SHA256

    0e07af6d28efb5c7dc0836ff2bdc27eea35184e0cef6a42a07ccf9954ec02ad0

  • SHA512

    45418e0d76d62631c335069bd7a4f351edc0a6f49227ae32071c1b8a2c2fe2758be7f279e12ed7cb830f2c62c00794980bd856c8ec0002eaf149cedfaf11dba5

Malware Config

Extracted

Family

redline

Botnet

install

C2

31.41.244.92:6188

Attributes
auth_value
eb23a0ca5a38a3bf1eb16b2f08524f35

Targets

    • Target

      1448-64-0x0000000000280000-0x00000000002A0000-memory.dmp

    • Size

      128KB

    • MD5

      45776fba0e7012c618d37a47b8cc259d

    • SHA1

      a5101b2a422a8e66d6ea673e803d9035add3a5ed

    • SHA256

      0e07af6d28efb5c7dc0836ff2bdc27eea35184e0cef6a42a07ccf9954ec02ad0

    • SHA512

      45418e0d76d62631c335069bd7a4f351edc0a6f49227ae32071c1b8a2c2fe2758be7f279e12ed7cb830f2c62c00794980bd856c8ec0002eaf149cedfaf11dba5

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation