General

  • Target

    feb75ffcc4337f81bdcb6729465eb5cf6a90c537efd22129db39db472b6013e2

  • Size

    719KB

  • Sample

    230212-r29b5aef56

  • MD5

    67587bf2a1c0e409ecabbd598159afbc

  • SHA1

    9b856c7eba296908e137b6c6f61bc3462dd6c252

  • SHA256

    feb75ffcc4337f81bdcb6729465eb5cf6a90c537efd22129db39db472b6013e2

  • SHA512

    6d08b46e47ec107ef2ec204eb9e0d5620797e129f0f3848e93bc6feae3b0dbd7770b42a19b5ef64429aadab45c5b4a59cdc930b36b39bd083b794f2d76c78d83

  • SSDEEP

    12288:TMrgy907vZPnzGDkxXpGVbyeJZPpYgeSbAWPgaI+84aKug0N:vyeZPnrVqZPygfrga2PN

Malware Config

Extracted

Family

redline

Botnet

dunm

C2

193.233.20.12:4132

Attributes
  • auth_value

    352959e3707029296ec94306d74e2334

Targets

    • Target

      feb75ffcc4337f81bdcb6729465eb5cf6a90c537efd22129db39db472b6013e2

    • Size

      719KB

    • MD5

      67587bf2a1c0e409ecabbd598159afbc

    • SHA1

      9b856c7eba296908e137b6c6f61bc3462dd6c252

    • SHA256

      feb75ffcc4337f81bdcb6729465eb5cf6a90c537efd22129db39db472b6013e2

    • SHA512

      6d08b46e47ec107ef2ec204eb9e0d5620797e129f0f3848e93bc6feae3b0dbd7770b42a19b5ef64429aadab45c5b4a59cdc930b36b39bd083b794f2d76c78d83

    • SSDEEP

      12288:TMrgy907vZPnzGDkxXpGVbyeJZPpYgeSbAWPgaI+84aKug0N:vyeZPnrVqZPygfrga2PN

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks