General

  • Target

    1b96c1e9291f3d111b24f7fb621b0901c824faf3d05c00495d75b7a90a0e6409

  • Size

    478KB

  • Sample

    230212-dgqsdscb6z

  • MD5

    721a35dd3f4f59930c0486e1a291dac2

  • SHA1

    eb43c114cc36f68b36717bc422979d1c54ce068c

  • SHA256

    1b96c1e9291f3d111b24f7fb621b0901c824faf3d05c00495d75b7a90a0e6409

  • SHA512

    cbf06b7d7dbd38de8672a4ed6eca175226f0c7e6da6ff2167ad34a5dc2d4b0d1572d002c8bb692aea79eb8686da52509bb532bfa9645aae8e575225425ae97c4

  • SSDEEP

    12288:hMruy90mlc75xg54qsCWzkAcNHespFd8JyA:nygU+QWzyN+CFzA

Malware Config

Extracted

Family

redline

Botnet

fusa

C2

193.233.20.12:4132

Attributes
  • auth_value

    a08b2f01bd2af756e38c5dd60e87e697

Targets

    • Target

      1b96c1e9291f3d111b24f7fb621b0901c824faf3d05c00495d75b7a90a0e6409

    • Size

      478KB

    • MD5

      721a35dd3f4f59930c0486e1a291dac2

    • SHA1

      eb43c114cc36f68b36717bc422979d1c54ce068c

    • SHA256

      1b96c1e9291f3d111b24f7fb621b0901c824faf3d05c00495d75b7a90a0e6409

    • SHA512

      cbf06b7d7dbd38de8672a4ed6eca175226f0c7e6da6ff2167ad34a5dc2d4b0d1572d002c8bb692aea79eb8686da52509bb532bfa9645aae8e575225425ae97c4

    • SSDEEP

      12288:hMruy90mlc75xg54qsCWzkAcNHespFd8JyA:nygU+QWzyN+CFzA

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks